From: Junio C Hamano <gitster@pobox.com>
Date: Wed, 13 Oct 2021 17:03:04 GMT
Subject: Re: [PATCH v2 2/2] ssh signing: clarify trustlevel usage in docs
Message-ID: <xmqqfst4j1rr.fsf@gitster.g>
In-Reply-To: <20211013075107.8584-3-fs@gigacodes.de>

Fabian Stelzer <fs@gigacodes.de> writes:

>  SSH has no concept of trust levels like gpg does. To be able to differentiate
>  between valid signatures and trusted signatures the trust level of a signature
>  verification is set to `fully` when the public key is present in the allowedSignersFile.
> -Therefore to only mark fully trusted keys as verified set gpg.minTrustLevel to `fully`.
> -Otherwise valid but untrusted signatures will still verify but show no principal
> -name of the signer.
> +Otherwise the trust level is `undefined` and git verify-commit/tag will fail.
>  +
>  This file can be set to a location outside of the repository and every developer
>  maintains their own trust store. A central repository server could generate this

Perfect.  Thanks.

Will queue.