Migrate away from pool.sks-keyservers.net

[philihp]

Would you be open to a PR that switches from pool.sks-keyservers.net to keys.openpgp.org?

The SKS package itself being written in Ocaml has struggled to find maintainers and fragile as it crashes when abusive requests are sent. Hagrid (keys.openpgp.org), on the other hand, is a new keyserver written in Rust and complies with the GDPR laws by verifying email addresses and allowing revocation.

Most of the work here would entail asking the owners of existing keys to verify their listed emails, which I'm down to do.

[lazka]

Do you mean for the pacman keyring? From what I remember the problem was that we have two keys per email/person in the key ring, one as a master key and one as a packager key, and keys.openpgp.org didn't allow multiple keys per email. (and in addition I have my non-msys2-related primary key on keys.openpgp.org as well, so three keys in total)

I was thinking of moving to keyserver.ubuntu.com, since that seems to be the most fast/stable one I know.

[philihp]

Ah, multiple keys per one email would be an issue. They could be moved to subkeys of one master key, but that's a lot of tricky work for little gain.

keyserver.ubuntu.com is also very stable and supported. I'd be happy to take on this work.

[lazka]

@philihp just wondering, what's your motivation here?

@elieux thoughts on moving our default pacman keyring config to keyserver.ubuntu.com?

[philihp]

@lazka helping to push along gpg's infra before it falls over on itself

[elieux]

Given the shutdown of the SKS pool, we have to do something now. I'd be happy to switch right now, if we could do it just for Pacman, but I'm not sure if that's practical.

It'd be nice to see what Arch Linux decides on (and what GnuPG itself does, if anything), but maybe a completely separate keyserver like Ubuntu's or MIT's is a good enough choice for us that we won't need to follow upstream.

[lazka]

PR to change the msys default: msys2/MSYS2-packages#2563

[lazka]

upstream also switched to ubuntu keyservers shortly after.

If we ever have to move to something else then it's likely going to be WKD, like Arch Linux: msys2/MSYS2-keyring#13

That will need some coordination an re-signing keys though..