Debian Account Manager Key Revocation Responsibilities

The Debian Account Manager (DAM) holds primary administrative authority over developer membership and access rights across the Debian project, serving as the critical authority for managing and approving cryptographic key revocations. This article outlines the specific responsibilities of the DAM regarding OpenPGP key revocation, explaining how the role interacts with the Debian keyring, the distinction between administrative authority and technical maintenance, and the security procedures followed when a key is compromised, replaced, or retired.

The Distinction Between DAM and Keyring Maintainers

In the Debian infrastructure, cryptographic keys dictate access to core services, package upload permissions via the Debian Archive Kit (dak), and voting rights. While Debian Keyring Maintainers technically manipulate the keyring packages and push updates to the keyservers, the Debian Account Managers hold the policy and governance authority. Keyring maintainers do not add, revoke, or permanently remove an official Debian Developer’s key from the active keyrings without explicit direction or validation from a DAM.

Key Compromise and Emergency Revocations

When a Debian Developer loses access to their private key or suspects a compromise, the DAM is the primary point of contact to mitigate supply chain risks to the Debian archive. In these events, the DAM's responsibilities include:

  • Identity Verification: The DAM verifies that the compromise or revocation request is authentic, using established web-of-trust paths, out-of-band verification, or previously established backup keys to prevent unauthorized lockouts.
  • Immediate Access Revocation: The DAM instructs the removal or disabling of the developer's credentials across LDAP and system shell accounts to halt access to project-owned machines.
  • Keyring Revocation Notice: The DAM coordinates with Keyring Maintainers to import the developer’s revocation certificate and remove the compromised key from debian-keyring (specifically the active uploaders and non-uploading keyrings).

Managing Key Transitions

Debian Developers periodically replace older keys with stronger cryptographic algorithms or modern subkey configurations. In these standard scenarios, the DAM:

  • Validates the signed key transition statement, ensuring the cryptographic continuity between the old key and the new key.
  • Approves the addition of the new key and marks the legacy key for retirement.
  • Ensures that superseded keys are fully deprecated and no longer accepted by Debian infrastructure for uploads or membership voting.

Membership Status Changes and Retirement

Key revocation is an inherent part of managing project membership lifecycle events. When a developer retires, becomes inactive, or is expelled via project governance procedures:

  • Status Updates: The DAM updates the member's status in the Debian database.
  • Moving Keys to Non-Active Keyrings: The DAM authorizes moving the member’s public key from the active rings (debian-keyring) to the historical or emeritus keyrings (debian-nonupload or debian-maintainers where applicable, or removed entirely from active trusts).
  • Audit Trail: The DAM maintains an authoritative record of when and why a key was removed from the active trust list, ensuring complete transparency and traceability across the Debian ecosystem.