search

dashpay / dash

Dash - Reinventing Cryptocurrency
https://www.dash.org
MIT License
1.49k stars 1.2k forks source link

contrib: Replace developer keys with list of pgp fingerprints #3739

Open PastaPastaPasta opened 4 years ago

PastaPastaPasta commented 4 years ago

See https://github.com/bitcoin/bitcoin/pull/11909

Is this a sensible change that we should enact as well? It seems to me to not provide much benefit to remove the keys from the repo, however they point out some potential benefit such as dealing with " Outdated keys. Unclear whether and when to replace by fresh copies. Unclear when to add a key of a new developer or Gitian builder. "

Thoughts?

SecTec commented 3 years ago

IMHO I would include the PGP-keys fingerprints in the repository as part of the README.md and include the keys itself in the releases.

What is more relevant to me is that the keys are signed by each other. Right now I have the issue that I paused to use Dash for a couple of years and right now the PGP-key in use does not match the keys I have. So from the cryptographic perspective I can not trust the new "pasta"-key because it was not signed by the codablock-key (or some other key used for signing the older releases).