On Fri, Jul 06, 2018 at 08:18:32AM +0200, Michał Górny wrote: > > option a) > > 2 years + N: > > 2 weeks <= N <= 3 months. > > > > option b) > > Change the wording to be 'at most 2 years' instead of 'exactly 2 years'. > That *is* the wording. I apologize. I took ulm's post as canonical and didn't confirm in the original GLEP text.
Further change to follow in response to the original text. > > Separately: > > Is two weeks enough time for a new key distribution to users? > > I originally wanted to specify one month but k_f insisted on something > shorter. 2 weeks were the compromise we agreed on. That said, I'd say > weekly 'gpg --refresh' is what we should recommend as the bare minimum. > > That said, the point of two weeks is mostly to give us time to remind > developers that their key is expiring and to give them time to actually > read their mail and do it before it actually expires. Please let's start reminding them BEFORE that. I have seen a lot of .away files over the last decade, and taking a 2-week offline vacation does happen. -- Robin Hugh Johnson Gentoo Linux: Dev, Infra Lead, Foundation Treasurer E-Mail : robb...@gentoo.org GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85 GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136
signature.asc
Description: Digital signature
