onboard new PMC member - Githubissues

bastelfreak commented 1 year ago

[x] Add the new people to the Project-Maintainers group on GitHub, remove former PMC members if desired (this role is not exclusively for PMC members)
[x] In the organisation settings, set former PMC members from Owner to Member, update new PMC members to Owner
[ ] Try to establish a GPG relationship between all PMC members
- [x] Make sure GPG keys are published on GitHub (add .gpg at the end of user profile url)
- [ ] If possible use WKD to distrubte GPG keys
- [ ] Upload keys to keyserver.ubuntu.com and keys.openpgp.org
- [ ] In case people meet in person, for example during a conference, sign GPG keys
[x] Add new GPG keys to our plumbing repository and remove old keys
[x] Check that the key is valid for at least one year (one PMC term)
[x] Ensure that everybody can decrypt and encrypt our secrets
[ ] Add the mail address from all new members to our pmc@voxpupuli.org mailing list and remove former members
[ ] Promote every PMC member to an owner for our mailing list
[x] Ensure that they have a bouncer in at least #voxpupuli-pmc and #voxpupuli on Libera.Chat
[x] Configure a cloak if desired (voxpupuli/pmc/$nickname)
[x] Add them to the admin list for the #voxpupuli IRC channel, remove former PMC members
[x] Add them as admin at opencollective.com
[ ] Each PMC member should create an Hetzner Account at Hetzner
[ ] Invite each PMC member to the Hetzner Cloud project, remove former PMC members
[x] Add each PMC member at our GitHub sponsors page, remove former PMC members

bastelfreak commented 1 year ago

@smortex and @rwaffen please check the list above. I need your email address and a gpg key. please publish the key to keyserver.ubuntu.com and keys.openpgp.org. afterwards we can do some key signing.

bastelfreak commented 1 year ago

@ekohl your key is already in the plumbing repo, but maybe this is a good time to check if it's up2date and present on keyserver.ubuntu.com and keys.openpgp.org.

smortex commented 1 year ago

@bastelfreak my key should be uploaded (and probably was already because when I search them I find older versions :upside_down_face:). The key BA4D1D955112336F should match the e-mail address I use in git / github / on my github profile. It is the key I use to sign my commits for some times. I though it was public on GitHub but this seems broken here: https://github.com/smortex.gpg (I may remove and re-upload it but fear that all my verified commits vanish :scream:)

Edit: Key is also on my website: https://romain.blogreen.org/pubkey.gpg

bastelfreak commented 1 year ago

maybe create a github support ticket, they are usually fast and competent. Should we wait with your key a bit, in case you need/want to create another one?

smortex commented 1 year ago

We can go with this key (82349A78E7C0B8070B5980FFBA4D1D955112336F). I'll contact support to ask them what to do: attempting to remove the key was warning me that what I don't want to happen was going to happen.

rwaffen commented 1 year ago

is there a preferred key algorithm? i have a ed25519 and this didn't work with my thunderbird. so i also have a rsa4096.

bastelfreak commented 1 year ago

both are fine. We just need it to encrypt the credentials we have.

rwaffen commented 1 year ago

then take ed25519 83CE67EC15FA9327838924766CE2B38A165F224B

bastelfreak commented 1 year ago

can you please upload your key to https://keyserver.ubuntu.com/ ?

rwaffen commented 1 year ago

been there, done that.

smortex commented 1 year ago

maybe create a github support ticket, they are usually fast and competent.

FYI, support told me to delete and re-upload: the warning is just so that people don't ask for a backup :smile:

Did that, my commits seems to still be verified and now https://github.com/smortex.gpg is working!

bastelfreak commented 5 months ago

I think I can close this one.

voxpupuli / plumbing

onboard new PMC member #270