Re: [RFC/PATCH] verify-tag: add --check-name flag

From: Michael J Gruber <git@drmicha.warpmail.net>
Date: Jun 9, 2016, 11:48 UTC
Message-ID: <c4b944c7-d72b-d84b-7c53-79708af250cb@drmicha.warpmail.net>
In-Reply-To: <xmqqk2hzldx8.fsf@gitster.mtv.corp.google.com>

Junio C Hamano venit, vidit, dixit 08.06.2016 20:43:

Show 34 quoted lines

> Santiago Torres <santiago@nyu.edu> writes:
> 
>> Sorry I'm trying to follow this. Would it be best to then have
>>
>>     verify-tag [--check-name=tagname] (tag-ref|tag-name|sha1)?
>>
>> and
>>
>>     tag -v [--check-name] (tag-name)
>>
>> Or would --format still work better?
> 
> No matter what you do, don't call that "--check-name".  It does not
> tell the users what aspect of that thing is "checked".  Avoid being
> asked "Does this check tagname to make sure it does not have
> non-ASCII letters?", in other words.
> 
> As a longer-term direction, I think the best one is to make what
> peff@ originally suggested, i.e.
> 
>     If we do go with the "print it out and let the caller do their own
>     checks" strategy, I think I'd prefer rather than "--show-tagname" to
>     just respect the "--format" we use for tag-listing. That would let you
>     do:
> 
>       git tag -v --format='%(tag)%n%(tagger)'
> 
>     or similar. In fact you can already do that with a separate step (modulo
>     %n, which we do not seem to understand here)...
> 
> work.
> 
> Thanks.
>

The extent of this thread shows (again) that assigning trust is an individual decision, and the base for that decision will be different in different projects. (While the gpg project keeps emphasizing that, it doesn't keep gpg users from thinking differently.)

All that git can realistically do is: A) provide the answer that gpg gives (which depends on the configured trust model, available keys and the trustdb entries) - this is about trust in the validity of the signature

B) provide easy access to all data that a project may potentially want to use for their manual or automatic decision - this is about trust in the meaning of the signature

We can do better for B), and we will with a for-each-ref'ed "git tag" that knows format strings.

Nota bene: A) really requires a tightened keyring and trustdb etc., something that is usually not found on the user side.

If we want to do all this "in git" we would need a "plug-in" infrastructure/trust helper that receives the tag object and decides about the trust (taking project specifics into account) - that is not that much different from scripting it around git, and could probably be "monkey patched in" today by specifying a different "gpg".

Michael