Chapter 2. Applying to Become a Maintainer 5
The recommended public key algorithm for use in Debian development work is the DSA (sometimes call
“DSS” or “DH/ElGamal”). Other key types may be used however. Your key length must be at least 1024
bits; there is no reason to use a smaller key, and doing so would be much less secure. Your key must be
signed with at least your own user ID; this prevents user ID tampering. gpg does this automatically.
Also remember that one of the names on your key must match the email address you list as the official main-
tainer for your packages. For instance, I set the maintainer of the developers-reference package to
“Adam Di Carlo <aph@debian.org>”; therefore, one of the user IDs on my key is that same value, “Adam
Di Carlo <aph@debian.org>”.
If your public key isn’t on public key servers such as pgp5.ai.mit.edu, please read the documentation
available locally in /usr/doc/pgp/keyserv.doc. That document contains instructions on how to put
your key on the public key servers. The New Maintainer Group will put your public key on the servers if it
isn’t already there.
Due to export restrictions by the United States government some Debian packages, including gnupg, are
located on ftp sites outside of the United States. You can find the current locations of those packages at
ftp://ftp.debian.org/debian/README.non-US.
Some countries restrict the use of cryptographic software by their citizens. This need not impede one’s ac-
tivities as a Debian package maintainer however, as it may be perfectly legal to use cryptographic products
for authentication, rather than encryption purposes (as is the case in France). The Debian Project does not
require the use of cryptography qua cryptography in any manner. If you live in a country where use of cryp-
tography even for authentication is forbidden then please contact us so we can make special arrangements.
Once you have all your information ready, and your public key is available on public key servers, send a
message to <new-maintainer@debian.org> to register as an offical Debian developer so that you
will be able to upload your packages. This message must contain your name and your valid e-mail address.
All the information discussed above is required after your Application Manager is assigned. Application
Manager is your agent in the registration process, and you can always ask him about the status of your
application. You can check the Application StatusBoard (http://nm.debian.org/) as well.
For more details, please consult New Maintainer’s Corner (http://www.debian.org/devel/join/
newmaint) at the Debian web site.
Once this information is received and processed, you should be contacted with information about your new
Debian maintainer account. If you don’t hear anything within a month, please send a followup message
asking if your original application was received. Do not re-send your original application, that will just con-
fuse the New Maintainer Group. Please be patient, especially near release points; mistakes do occasionally
happen, and people do sometimes run out of volunteer time.
2.3 Debian Mentors
The mailing list <debian-mentors@lists.debian.org> has been set up for novice maintainers
who seek help with initial packaging and other developer-related issues. Every new developer is invited to