Re: [PATCH v3 2/9] ssh signing: add documentation

From: Junio C Hamano <gitster@pobox.com>
Date: Jul 15, 2021, 16:29 UTC
Message-ID: <xmqqfswftuax.fsf@gitster.g>
In-Reply-To: <cf9aaa48-ea49-e3c2-9909-486d9a3f7aac@gigacodes.de>

Fabian Stelzer <fs@gigacodes.de> writes:

Show 5 quoted lines

>>> +gpg.ssh.keyring::
>>> ...
> maybe keeeping the name "allowedSignersFile" like its called in the
> ssh manpage will make this clearer without needing a lot of extra
> explanation?

Yup, that sounds like an excellent way to present this to our users.

Show 8 quoted lines

> SSH has nothing compared to the gpg trust levels. Your key is either
> in the allowed signers file or it is not. However even if it is not in
> the file then the signature might still be "Good" but has no matching 
> principal to it. To be able to differentiate the two "Good" cases i
> used the existing gpg trust levels. This way if you set
> gpg.mintrustlevel = fully then the signatures with no matching key in
> the allowed signers file will fail to verify. Otherwise they will
> verify but show a message that no principal matched with this key.

Sounds sensible. Our task is to make sure that readers (not me, who have already been spoon-fed the answer by you just now) would reach the above understanding by just reading what we put in the documentation.

Thanks.