2 ms·
Hmm, with Ubuntu, there is not a required web-of-trust, as the uploader merely adds their key to their account using Launchpad. If the user was able to access
by Daviey 13y ago
Hmm, with Ubuntu, there is not a required web-of-trust, as the uploader merely adds their key to their account using Launchpad.
If the user was able to access their Launchpad account, there is implicit trust.
There isn't a Ubuntu shared keyring for each developer/maintainer, as there is with Debian - rather, a handful of shared keys, where the secret is only held by the infra. These are currently, Apt Archive, CD image & now Ubuntu Cloud Archive.
- rlpb 13y agoBut Launchpad accounts only get upload rights when their prior work is reviewed by the developer membership board. And the prior work is identified against that same Launchpad account. So there is a root of trust: it's the developer membership board. It just happens that the trust system isn't implemented using a PGP web of trust directly.