Hi all,
I want to give everyone a heads up about the kernel.org outage. As most of you know, kernel.org was compromised by an outside hacker and has been taken down for rebuild. You can find the coverage on lwn.net[1][2][3].
[1] http://lwn.net/Articles/457142/ - Initial notice [2] http://lwn.net/Articles/458809/ - Further details [3] http://lwn.net/Articles/460376/ - An update from H. Peter Alvin
Because kernel.org is central to the kernel development process, particularly since the majority of git trees pulled by Linus live there, the security of kernel.org is of paramount importance. It is critically important that when the kernel.org infrastructure comes back up that it not be vulnerable to another attack, so as part of rebuilding the infrastructure, all of the policies around how developers access kernel.org as well as how Linus pulls maintainer trees is under review.
The reason for this email is to give you a heads up about what you should expect when kernel.org becomes live again. There is a strong likelyhood that maintainers will need to start GPG signing branches that they will ask Linus to pull. Nothing has been decided firmly (indeed, we won't know until Linus himself makes a decision about what he will accept), and it will definitely be a topic for the upcoming Kernel Summit at the end of October. However, it is worth taking the opportunity now to get familiar with GPG and to create a key for yourself. The Debian developers among you will already be familiar with this process, /even if you don't have a kernel.org account/. The Debian keysigning page[4] is a good place to start reading.
[4] http://wiki.debian.org/Keysigning
I'll post more details as I learn them. In the mean time, you can email me if you have any questions and I'll do my best to answer them.
g.