Subject: Re: [PATCH v3 2/9] ssh signing: add documentation

From: Junio C Hamano <[email-masked]>
Date: Thu, 15 Jul 2021 09:29:10 -0700

Fabian Stelzer <[email-masked]> writes:

>>> +gpg.ssh.keyring::
>>> ...
> maybe keeeping the name "allowedSignersFile" like its called in the
> ssh manpage will make this clearer without needing a lot of extra
> explanation?

Yup, that sounds like an excellent way to present this to our users.

> SSH has nothing compared to the gpg trust levels. Your key is either
> in the allowed signers file or it is not. However even if it is not in
> the file then the signature might still be "Good" but has no matching 
> principal to it. To be able to differentiate the two "Good" cases i
> used the existing gpg trust levels. This way if you set
> gpg.mintrustlevel = fully then the signatures with no matching key in
> the allowed signers file will fail to verify. Otherwise they will
> verify but show a message that no principal matched with this key.

Sounds sensible.  Our task is to make sure that readers (not me, who
have already been spoon-fed the answer by you just now) would reach
the above understanding by just reading what we put in the
documentation.

Thanks.