2 ms·
> Sonatype are the community stewards. They make sure you have control over and email address and a packaging namespace. PGP is nice because it _requires_ an em
by woodruffw 3y ago
> Sonatype are the community stewards. They make sure you have control over and email address and a packaging namespace. PGP is nice because it _requires_ an email address tied to a cert.
This isn't a property anywhere in PGP: a PGP identity can be an email, or it can be any other free-form identifier.
Individual keyservers can gatekeep inclusion based on email verification (which itself is flimsy, but ignoring that for the moment), but there's no strong guarantee that any particular keyserver does that (or will continue to do it, as a matter of policy). Uploading certs for "bill@microsoft.com" was a joke on the SKS servers for years.
- exabrial 3y agoThey check you have control over the email address.
- woodruffw 3y agoWho is “they”? The current OpenPGP keyserver does this, but again: that’s new, and it’s a matter of policy, not protocol. PGP itself isn’t involved in that.
- exabrial 3y agoSonatype
- woodruffw 3y agoThat’s good! But again: that’s not a property of PGP. It’s an operational burden that an unrelated (corporate?) entity has chosen to assume.
- exabrial 3y agoEssentially. The decision was actually made by the maven central maintainers at the apache source foundation, and Sonatype implemented the decision.