News for hackers. Stuff that matters.

A comment on What does a PGP signature on a Git commit prove?. Parent comment

Re:What does a PGP signature on a Git commit prove? by waynesonfire on Wednesday March 31, 2021 @08:01AM (#26646106)
> Kernel.org web of trust PGP keys used by members of kernel.org are cross-signed by other members of the Linux kernel development community (and, frequently, by many other people). If you wanted to verify the validity of any key belonging to a member of kernel.org, you could review the list of signatures on their public key and then make a decision whether you trust that key or not. See the Wikipedia article on the subject of the Web of Trust.

https://www.kernel.org/signature.html

Looks like the kernel.org folks actually use the web of trust model.

[ Parent | on HN ]
Re:What does a PGP signature on a Git commit prove? by globular-toast on Wednesday March 31, 2021 @08:42AM (#26646489)
Yeah, they do. There's a video of Linus talking from many years ago about git where he says web of trust is the only way to do security.
[ Parent | on HN ]