Should Trusts be more granular?

[quintesse]

Right now trusts is at domain level, but especially with sources like GitHub, GitLab, etc it would be really nice if we could trust at the level of user/organization or even individual repos.

Wdyt?

[maxandersen]

sorry i missed this - the trusts is at url level, so it can include paths too.

What you might refer to is that the url shown for option #1 sometimes becomes the host where it actually should be the specific url.

[maxandersen]

its a bug we should fix

[quintesse]

Ok. So perhaps we could be offering more options?

For example if there's a URL with path we could offer 2 options: 1 for the full URL and one just for the domain?
And if we detect that it's a Git URL we could add 2 additional options: "trust repository" and "trust organization"?

[maxandersen]

I agree we should at least have a "trust this explicit full url" option and then the last option be what we have today - result of goodTrustURL() which is meant to choose the more meaningful "group" to trust, i.e. org or user in github, user id on twitter etc.

And posibbly make the fallback for trusturl be just one level up instead of the root url which is the default now.