Improve config file handling

[lukehinds]

Right now we are doing this relative path

ruby-sigstore/lib/rubygems/sigstore/config.rb

Lines 25 to 28 in 9948fe0

	settings_file = Config.setting_files(
	File.expand_path('../../../../', __FILE__),
	'development' # TODO: Get this from gemspec
	)

It works, but its ugly, and how well will it work, should it not allow some customisation around location of the file etc?

@endorama you might have some ideas here.

[endorama]

Where do we want to allow this config file to be present? (es: gem root, at a specific absolute location, user home folder, in all this place with a precedence). My personal take would be: multiple places with this precendece:

• check gem root
• check user home folder (i.e. $HOME/.config/sigstore/config.yaml)
• check absolute path (i.e. /etc/sigstore/config.yaml)

Are defaults defined somewhere, so we can check if the file exists and proceed even if it doesn't? If they are not, I would add them.

[ezkl]

It might be worth looking into the XDG Base Directory Specification.

There is a reasonably well-done gem that can assist with handling OSs that don't follow the specification by default (ex: macOS.)

[endorama]

It might be worth looking into the XDG Base Directory Specification.

Link returns 404 for me, but I found this Arch Wiki page that summarize it and this Gnome Developer page that seems a copy of it.

---

A note on leveraging only XDG spec is that as far as I know XDG folders are used for user related data/configuration files and not system wide ones. So a system wide folder like /etc/sigstore would not be present in any of the XDG paths.

If we want to provide a way to configure sigstore system wide we may want to add that (i.e. XDG data folders + /etc/sigstore).