Re: [RFC/PATCH] verify-tag: add --check-name flag

Junio C Hamano venit, vidit, dixit 08.06.2016 20:43:

Santiago Torres [off-list ref] writes:

quoted

Sorry I'm trying to follow this. Would it be best to then have

    verify-tag [--check-name=tagname] (tag-ref|tag-name|sha1)?

and

    tag -v [--check-name] (tag-name)

Or would --format still work better?

No matter what you do, don't call that "--check-name".  It does not
tell the users what aspect of that thing is "checked".  Avoid being
asked "Does this check tagname to make sure it does not have
non-ASCII letters?", in other words.

As a longer-term direction, I think the best one is to make what
peff@ originally suggested, i.e.

    If we do go with the "print it out and let the caller do their own
    checks" strategy, I think I'd prefer rather than "--show-tagname" to
    just respect the "--format" we use for tag-listing. That would let you
    do:

      git tag -v --format='%(tag)%n%(tagger)'

    or similar. In fact you can already do that with a separate step (modulo
    %n, which we do not seem to understand here)...

work.

Thanks.

The extent of this thread shows (again) that assigning trust is an
individual decision, and the base for that decision will be different in
different projects. (While the gpg project keeps emphasizing that, it
doesn't keep gpg users from thinking differently.)

All that git can realistically do is:
A) provide the answer that gpg gives (which depends on the configured
trust model, available keys and the trustdb entries) - this is about
trust in the validity of the signature

B) provide easy access to all data that a project may potentially want
to use for their manual or automatic decision - this is about trust in
the meaning of the signature

We can do better for B), and we will with a for-each-ref'ed "git tag"
that knows format strings.

Nota bene: A) really requires a tightened keyring and trustdb etc.,
something that is usually not found on the user side.

If we want to do all this "in git" we would need a "plug-in"
infrastructure/trust helper that receives the tag object and decides
about the trust (taking project specifics into account) - that is not
that much different from scripting it around git, and could probably be
"monkey patched in" today by specifying a different "gpg".

Michael