parsing of ssh-keygen allowed signers file format

[castedo]

Implements low-level parsing for enhancement #1431

[jelmer]

This is all ssh-specific (rather than Git) and the referenced source file is from openssh, any reason this shouldn't live in sshsig?

[castedo]

This is all ssh-specific (rather than Git) and the referenced source file is from openssh, any reason this shouldn't live in sshsig?

In #1394 (comment) you wrote:

The support for parsing allowed signers is git-specific and should be a part of dulwich, not sshsig. Applying the rules in such a file is also non-trivial and you'd want support from dulwich to apply them.

But I'm fine with this code living in sshsig if you prefer it not be in dulwich.

I agree it is ssh specific. The utilityssh-keygen is defining the format.

[jelmer]

This is all ssh-specific (rather than Git) and the referenced source file is from openssh, any reason this shouldn't live in sshsig?

In #1394 (comment) you wrote:

The support for parsing allowed signers is git-specific and should be a part of dulwich, not sshsig. Applying the rules in such a file is also non-trivial and you'd want support from dulwich to apply them.

But I'm fine with this code living in sshsig if you prefer it not be in dulwich.

I agree it is ssh specific. The utilityssh-keygen is defining the format.

Ah, sorry - to maybe make it a bit more nuanced: I think the parsing should be in sshsig and the application (which would be importing the parser from sshsig) in dulwich since that needs dulwich-specific context, if that makes sense? Maybe I am being overly cautious - we can always move the code later anyway.

[castedo]

Makes sense to me that dulwich, not sshsig, would have (yet-to-exist) code that replicates the logic of the git CLI as to where to find the allowed signers file based on git config files (and probably environment variables too).

Seems reasonable to me that sshsig contain the basic allowed signers parsing code that I've already coded (and am using in 'hidos' in a hidos specific way).

I've go ahead and close this PR and create a new one in the sshsig repo to have the sshsig package include allowed signer parsing code.