Key consistency checks

This requirement has been approved by Mattia Rizzolo <mattia@debian.org> 2 months ago.

This process has been closed by noodles on 2021-03-24: no further modifications are possible.

Potential problems

no UID found that fully satisfies requirements
key has issues key_size_2048

Every Debian member needs a GPG key of sufficient strength. In addition, all keys should be certified so we can link them to a real-world identity.

The normal requirements are:

the key should be type RSA and version 4 or greater
the key should have the sign, certify and encrypt capabilities (subkeys are encouraged)
the primary cryptographic material should be at least 4096 bits
the UIDs used by an applicant to work in the project should be signed by at least two existing Debian members (1 for DM applications)
as an alternative to the previous requirement, the key can be endorsed (see link at the bottom of the page) by multiple Debian Members (the number of required endorsements depends on the endorsement's age and nature)
pseudonyms or anonymity are acceptable in certain circumstances

If the key does not meet these requirements, and you would struggle to create one which does, contact Front Desk.

Keys are first searched in hkps://keyring.debian.org. If no key is found, then the key will be imported from hkps://keyserver.ubuntu.com/. Please ensure that you have sent your key to Ubuntu's key server. Sending public keys to keyring.debian.org will only work if your key is already in Debian's keyring and will only be taken into account after the Keyring Maintainers updated it. For Debian Maintainers and Developers, please remember to send your key to both servers.

This check will be approved manually by Front Desk as the application progresses.

Key check results

OpenPGP fingerprint	0CFE 997B 7245 80A7 FA72 F8CF F0B1 10E7 5A69 2F32
Main key	key_size_2048 (last updated: 2021-04-10 00:17 UTC)
UID Gunnar Hjalmarsson <gunnarhj, ubuntu.com>	ok, 0 non-DD sigs, 0 DD sigs: none
UID Gunnar Hjalmarsson <ubuntu, gunnar.cc>	ok, 0 non-DD sigs, 0 DD sigs: none
UID Gunnar Hjalmarsson <gunnarhj, debian.org>	ok, 0 non-DD sigs, 0 DD sigs: none

Active key endorsements

Endorsed by

Date

Statement

Actions

laney

2021-02-15
(2 months ago)

Gunnar and I have worked together for quite a few years now.

Here's the main thing that convinces me that this key is Gunnar's. This key is
linked to Gunnar's Launchpad account, and is authorised to make uploads to
parts of Ubuntu. Over the years, we've had many conversations in IRC in public
and some in private. These are usually about changes which we're making in
Ubuntu. We will often discuss what should be changed, come to a consensus and
then Gunnar implements the change. These changes, correlating with the results
of our discussions, were inevitably signed with this key. A couple of examples
which can be verified (replace ' at ' with '@'), going back through time:

https://lists.ubuntu.com/archives/hirsute-changes/2020-November/002062.html
https://lists.ubuntu.com/archives/bionic-changes/2018-March/010906.html

Latterly, when discussing Gunnar's application to become a DD¹, we have
exchanged a few more actual signed emails using this key.

I sent Gunnar an encrypted mail to the address below, containing a token, and
he was able to repeat it back to me. I have also recently received signed
emails using the same key.

Recently I sponsored a few uploads to Debian, again presented with this key via
signed tags on salsa.

https://tracker.debian.org/news/1229699/accepted-ibus-typing-booster-2104-1-source-into-unstable/
https://tracker.debian.org/news/1203041/accepted-im-config-046-1-source-into-unstable/
https://tracker.debian.org/news/1203040/accepted-ibus-typing-booster-2102-1-source-into-unstable/

Due to the long-term interactions we had, I'm convinced that Gunnar
Hjalmarsson as they present themselves on nm.debian.org is the rightful
owner of both email ubuntu@gunnar.cc and GPG key 0CFE 997B 7245 80A7
FA72 F8CF F0B1 10E7 5A69 2F32.

2021-02-15

¹ https://nm.debian.org/process/851/

Signed with key 3D0E FB95 E7B5 237F 16E8 2258 E352 D5C5 1C50 41D4

View raw

seb128

2021-02-08
(2 months ago)

For nm.debian.org, at 2021-02-08:
I've worked with Gunnar for 10 years now, mostly in Ubuntu but also in Debian sponsoring some of input method and desktop works.

For this past work, Gunnar Hjalmarsson often sent mails using the email address ubuntu@gunnar.cc
and used his GPG key with fingerprint 0CFE 997B 7245 80A7 FA72  F8CF F0B1 10E7 5A69 2F32.

I've made sure that he's able to decrypt encrypted messages sent to this key and able to sign messages with the same key.

Due to the long-term interactions we had, I'm convinced that Gunnar Hjalmarsson as they present themselves on nm.debian.org is the rightful owner of both email ubuntu@gunnar.cc and GPG key 0CFE 997B 7245 80A7 FA72  F8CF F0B1 10E7 5A69 2F32.

Recent examples of sponsoring I did for Gunnar which were built from git where he signed the tags with his key

https://salsa.debian.org/input-method-team/marisa
* debian/0.2.6-3_exp2

https://salsa.debian.org/debian/ibus
* debian/1.5.23-2

https://salsa.debian.org/gnome-team/gnome-user-docs
* debian/3.38.1-1

Signed with key 4724 B86F 47E0 2915 DEEA 49E2 3EBD 4490 3EDB 0496

View raw

Log

Date	Author	Action	Content	Public
2021-02-15 13:22	mattia	req_approve	Requirement approved	yes