On Sat, Jan 20, 2024 at 11:35:18AM -0800, Linus Torvalds wrote: > Guess why I don't? BECAUSE NOBODY ELSE DOES THAT POINTLESS EXPIRY DANCE. So I guess I need to confess. I haven't been doing the expiry dance (which I started doing because GPG revocation certificates are also a disaster). There are certainly those folks who recommend it as a best practice[1]. [1] https://www.g-loaded.eu/2010/11/01/change-expiration-date-gpg-key/ However, I tend to set the expiration 6 to 12 months in advance, and make sure I renew them 3 months or so before they expire, and then I make a point of sending them to keys@xxxxxxxxxxxxxxxx to update the the kernel keyring, as documented here[2]. [2] https://korg.docs.kernel.org/pgpkeys.html Linus, you haven't been complaining about my key, which hopefully means that I'm not causing you headaches (or at least I hope so). Would it be perhaps because you are periodically running scripts/korg-refresh-keys as documented in [2]. Or perhaps you are running it out of cron or a systemd timer (again, as documented in [2])? Unlike James, I've tried to use DANE, since about the only thing that has as disastrous a user experience as gpg is DNSSEC. :-) I just manually upload keys to the kernel and Debian keyrings, and it's been working out, apparently without much pain for either me or to those who rely on my keys --- at least, no one as complained to me so far.... - Ted
