Directory for people's public keys about guix.sigs

[hebasto]

If we could assume that users use the same keys to sign guix builds as they use to sign commits, we could count on personal keys like https://github.com/hebasto.gpg

[maflcko]

We can check via CI that everyone who uploads has a key and that signatures are valid.

So whenever a key expires, or is revoked, or otherwise gets stale, it will result in a red CI?

By including a directory here, you are basically (manually) running a keyserver. This will likely require scripts to maintain the keyserver directory in this repo.

[laanwj]

I'm not sure. I've floated similar ideas before after being frustrated at the keyservers once again. But it seems like a lot of maintenance overhead. But if you're willing to maintain this, why not.

By including a directory here, you are basically (manually) running a keyserver. This will likely require scripts to maintain the keyserver directory in this repo.

Good point. You could automate it by periodically fetching the keys in builder-keys from the keyserver, or running refresh-keys. Which makes you essentially a keyserver.

Maybe this directory can be used: https://github.com/bitcoin/bitcoin/tree/master/contrib/builder-keys

If we do it it should be a separate repo, not clutter the main one.

[gruve-p]

Maybe this directory can be used: https://github.com/bitcoin/bitcoin/tree/master/contrib/builder-keys

[maflcko]

I guess this can be done by having the CI check the key and attestation in every pull request, but only for the keys/attestations changed in the pull request?

[maflcko]

Fixed in #535