On Fri, 06 Jul 2018 08:51:12 +0200 Michał Górny <mgo...@gentoo.org> wrote:
> W dniu pią, 06.07.2018 o godzinie 06∶28 +0000, użytkownik Robin H. > Johnson napisał: > > On Fri, Jul 06, 2018 at 08:18:32AM +0200, Michał Górny wrote: > > > > option a) > > > > 2 years + N: > > > > 2 weeks <= N <= 3 months. > > > > > > > > option b) > > > > Change the wording to be 'at most 2 years' instead of 'exactly > > > > 2 years'. > > > > > > That *is* the wording. > > > > I apologize. I took ulm's post as canonical and didn't confirm in > > the original GLEP text. > > > > Further change to follow in response to the original text. > > > > > > Separately: > > > > Is two weeks enough time for a new key distribution to users? > > > > > > I originally wanted to specify one month but k_f insisted on > > > something shorter. 2 weeks were the compromise we agreed on. > > > That said, I'd say weekly 'gpg --refresh' is what we should > > > recommend as the bare minimum. > > > > > > That said, the point of two weeks is mostly to give us time to > > > remind developers that their key is expiring and to give them > > > time to actually read their mail and do it before it actually > > > expires. > > > > Please let's start reminding them BEFORE that. I have seen a lot of > > .away files over the last decade, and taking a 2-week offline > > vacation does happen. > > The problem is, Gentoo developers are really hostile people. If you > remind them *before* the term, they are not very nice because how does > someone dare remind very important developer who was planning to do it > week before expiration, and now he needed to waste his precious time > reading your mail. > I never experienced a single developer show or say anything like you are suggesting. Most, thanked me for the reminder whether it was in IRC or email. And since I always cc'd the gkeys alias (most needed changes to meet the spec too), I'm sure Kristian will confirm this. -- Brian Dolbec <dolsen>
pgp5aZWnCcqDB.pgp
Description: OpenPGP digital signature
