Since we can do lists in the configuration, I think you should just require the value to be a list and not try to accept a comma-separated string.

It feels like this block should be its own function/method, to be easily tested independently and to make this already-long method shorter.

Could you please also add an example configuration in the robosignatory.toml file?

Hmm, this test is getting pretty complex, don't you think? Probably due to the parameters.
I mean when our unit tests have so many branches they need their own unit tests, something's going pretty wrong ;-)

I'm not sure what the best way would be to avoid cut-n-paste, maybe verification methods in the class?

I've broken out some code of that test method:

• preparing/tweaking the test data
• determining log messages and exceptions (if any) to expect

That's much clearer, thanks.

@puiterwijk do you want to have a look at this code, before I merge it? I'm asking because there's a security aspect to it. If you don't have time, don't worry.

@abompard I'm going to trust your judgement here :).
If you think it's fine, feel free to go ahead and merge.