In version 2 of gitsign, the flags --certificate-oidc-issuer & --certificate-identity are now required to be passed to the gitsign verify command to tell gitsign which identity and issuer is expected to be valid. That's fine, and I understand why this decision was made. The problem is that it not always obvious to the user when signing a commit or tag what the URI for the certificate-oidc-issuer is, or which certificate-identity was used. For example, I signed a commit using my GitHub identity. When I went to verify, I was unsure what URI to pass for --certificate-oidc-issuer. I tried https://github.com, but that didn't work. It took some digging to figure out that what I wanted to pass was https://github.com/login/oauth. Also, I initially assumed the value I should pass for my --certificate-identity would be the GitHub privacy-sparing email. I didn't realize that it would use my private email, which meant I was passing the wrong value to --certificate-identity as well.
I suggest that, after a user signs a commit or tag, gitsign displays the value for certificate-oidc-issuer and certificate-identity that was just used to sign. That will make it obvious to the user which values to pass to the flags when verifying. I also recommend adding a command to gitsign to allow a user to inspect the value for --certificate-identity & --certificate-oidc-issuer that was used for a commit without actually verifying it. I understand that you want to ensure that people don't just blindly trust a verification without knowing who actually did the signing, however in an open-source project with multiple contributors it can be cumbersome to try to guess the correct identity for any particular commit, particularly since people who commit using their GitHub privacy-sparing e-mail addresses will show that address in the regular Git commit log, but if someone wants to verify using gitsign they would need to pass in that user's private e-mail address, which he/she may not know.
In version 2 of gitsign, the flags
--certificate-oidc-issuer&--certificate-identityare now required to be passed to thegitsign verifycommand to tell gitsign which identity and issuer is expected to be valid. That's fine, and I understand why this decision was made. The problem is that it not always obvious to the user when signing a commit or tag what the URI for thecertificate-oidc-issueris, or whichcertificate-identitywas used. For example, I signed a commit using my GitHub identity. When I went to verify, I was unsure what URI to pass for--certificate-oidc-issuer. I triedhttps://github.com, but that didn't work. It took some digging to figure out that what I wanted to pass washttps://github.com/login/oauth. Also, I initially assumed the value I should pass for my--certificate-identitywould be the GitHub privacy-sparing email. I didn't realize that it would use my private email, which meant I was passing the wrong value to--certificate-identityas well.I suggest that, after a user signs a commit or tag, gitsign displays the value for
certificate-oidc-issuerandcertificate-identitythat was just used to sign. That will make it obvious to the user which values to pass to the flags when verifying. I also recommend adding a command togitsignto allow a user to inspect the value for--certificate-identity&--certificate-oidc-issuerthat was used for a commit without actually verifying it. I understand that you want to ensure that people don't just blindly trust a verification without knowing who actually did the signing, however in an open-source project with multiple contributors it can be cumbersome to try to guess the correct identity for any particular commit, particularly since people who commit using their GitHub privacy-sparing e-mail addresses will show that address in the regular Git commit log, but if someone wants to verify using gitsign they would need to pass in that user's private e-mail address, which he/she may not know.