Implement flags over native gem & config handling #19
Conversation
This change allows sigstore subcommands such as `--sign` and `--verify` to layer on top of the existing gem commands. This way a user can call `gem build --sign` and sigstore will sign during the gem build process. Likewise they can run `gem install --verify` This also replaces run time flags for config options, namely as most users are not likely going to use flags. Using config means that defaults are present and they can be overidden by env vars, such as `export sigstore_fulcio_host=http://127.0.0.1:3000`. The main requirement is that they prefix `sigstore_` If flags are still really desired we can rig them back in. I also removed as config plays easier with overiding subcommands against the generic gem command. Signed-off-by: Luke Hinds <lhinds@redhat.com>
Signed-off-by: Luke Hinds <lhinds@redhat.com>
|
Picture is worth a thousands words and all that
|
|
@cpanato just in regards to the license boiler check , do we want license header in config files? There is no code to copyright, its just stuff like host, ports, client ids |
|
@lukehinds make sense Luke, just need to see how to skip those files in the checker |
Signed-off-by: Luke Hinds <lhinds@redhat.com>
Signed-off-by: Luke Hinds <lhinds@redhat.com>
Signed-off-by: Bob Callaway <bob.callaway@gmail.com>
|
Are you ok with this now @bobcallaway , the CI failure is from the boilerplate license check action failing as it expects a license header in a config file. |
|
the tool we are using if not get merged, we might want to use the boilerplate check from Kubernetes which are more flexible https://github.com/kubernetes/repo-infra/tree/master/verify let me know what are your thoughts on this |
This is up, but I don't think its an ideal approach as you have to specifically name the files , it would be better to have it ignore extensions: |
|
agree @lukehinds |
I much prefer this approach! |
|
ok, opened a PR: google/addlicense#75 lets see the maintainers thoughts |
This change allows sigstore subcommands such as
--signand--verifyto layer on top of the existing gem commands. This waya user can call
gem build --signand sigstore will sign duringthe gem build process. Likewise they can run
gem install --verifyThis also replaces run time flags for config options, namely as
most users are not likely going to use flags. Using config means
that defaults are present and they can be overidden by env vars,
such as
export sigstore_fulcio_host=http://127.0.0.1:3000. Themain requirement is that they prefix
sigstore_If flags are still really desired we can rig them back in. I also
removed as config plays easier with overiding subcommands against
the generic gem command.
Signed-off-by: Luke Hinds lhinds@redhat.com