{"thread":{"id":"22281","subject":"why is tagger header optional?","startedAt":"2010-01-19T06:09:46Z","lastAt":"2010-01-19T06:44:54Z","messageCount":6,"participants":["Shawn O. Pearce","Junio C Hamano","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"132073","messageId":"20100119060946.GA23212@spearce.org","threadId":"22281","inReplyTo":null,"subject":"why is tagger header optional?","fromName":"Shawn O. Pearce","fromEmail":"spearce@spearce.org","sentAt":"2010-01-19T06:09:46Z","receivedAt":"2010-01-19T06:09:46Z","isPatch":false,"sender":{"key":"spearce@spearce.org","avatar":"https://avatars.githubusercontent.com/u/34844?v=4"},"body":"So why is it legal to omit the tagger header from a tag?\n\nE.g. the Linux kernel tag v2.6.12 has no tagger header:\nhttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tag;h=26791a8bcf0e6d33f43aef7682bdb555236d56de\n\nJGit is currently failing on this tag, because its fsck\nimplementation demands that a tag have a tagger header\nthat can be parsed as a person identity.\n\nLooking at tag.c's parse_tag_buffer(), the variable sig_line seems\nto be expected to point at the \"tagger \" header (given its name),\nbut its not actually validated as such.\n\nIs there a version of Git floating around that doesn't create a\ntagger header when creating a signed tag? WTF?\n\n-- \nShawn.\n"},{"id":"132075","messageId":"7vk4vebo6z.fsf@alter.siamese.dyndns.org","threadId":"22281","inReplyTo":"20100119060946.GA23212@spearce.org","subject":"Re: why is tagger header optional?","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2010-01-19T06:31:32Z","receivedAt":"2010-01-19T06:31:32Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"Shawn O. Pearce\" writes:\n\n> So why is it legal to omit the tagger header from a tag?\n>\n> E.g. the Linux kernel tag v2.6.12 has no tagger header:\n\nWe didn't.add tagger line until c818566 ([PATCH] Update tags to record who\nmade them, 2005-07-14), which is v0.99.1~9\n\nLinux 2.6.12 is a lot older than that. v2.6.13-rc4 in late July is the\nfirst one with tagger.\n"},{"id":"132076","messageId":"20100119063255.GC23212@spearce.org","threadId":"22281","inReplyTo":"7vk4vebo6z.fsf@alter.siamese.dyndns.org","subject":"Re: why is tagger header optional?","fromName":"Shawn O. Pearce","fromEmail":"spearce@spearce.org","sentAt":"2010-01-19T06:32:56Z","receivedAt":"2010-01-19T06:32:56Z","isPatch":false,"sender":{"key":"spearce@spearce.org","avatar":"https://avatars.githubusercontent.com/u/34844?v=4"},"body":"Junio C Hamano wrote:\n> \"Shawn O. Pearce\" writes:\n> \n> > So why is it legal to omit the tagger header from a tag?\n> >\n> > E.g. the Linux kernel tag v2.6.12 has no tagger header:\n> \n> We didn't.add tagger line until c818566 ([PATCH] Update tags to record who\n> made them, 2005-07-14), which is v0.99.1~9\n> \n> Linux 2.6.12 is a lot older than that. v2.6.13-rc4 in late July is the\n> first one with tagger.\n\nUgh. So its like the 100640 or whatever mode tags in the kernel\ntrees that are also considered bogus by today's standards, but have\nto be allowed because of the kernel history.\n\nThanks.\n\n-- \nShawn.\n"},{"id":"132077","messageId":"7vfx62bo0i.fsf@alter.siamese.dyndns.org","threadId":"22281","inReplyTo":"20100119063255.GC23212@spearce.org","subject":"Re: why is tagger header optional?","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2010-01-19T06:35:25Z","receivedAt":"2010-01-19T06:35:25Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"Shawn O. Pearce\" writes:\n\n> Junio C Hamano wrote:\n>> \"Shawn O. Pearce\" writes:\n>> \n>> > So why is it legal to omit the tagger header from a tag?\n>> >\n>> > E.g. the Linux kernel tag v2.6.12 has no tagger header:\n>> \n>> We didn't.add tagger line until c818566 ([PATCH] Update tags to record who\n>> made them, 2005-07-14), which is v0.99.1~9\n>> \n>> Linux 2.6.12 is a lot older than that. v2.6.13-rc4 in late July is the\n>> first one with tagger.\n>\n> Ugh. So its like the 100640 or whatever mode tags in the kernel\n> trees that are also considered bogus by today's standards, but have\n> to be allowed because of the kernel history.\n\nYeah; don't we have \"fsck --strict\" or something to take the distinction\ninto account, though? I don't recall if lack of tagger triggers the check\noffhand and I am too lazy to check.\n"},{"id":"132078","messageId":"20100119063743.GD23212@spearce.org","threadId":"22281","inReplyTo":"7vfx62bo0i.fsf@alter.siamese.dyndns.org","subject":"Re: why is tagger header optional?","fromName":"Shawn O. Pearce","fromEmail":"spearce@spearce.org","sentAt":"2010-01-19T06:37:43Z","receivedAt":"2010-01-19T06:37:43Z","isPatch":false,"sender":{"key":"spearce@spearce.org","avatar":"https://avatars.githubusercontent.com/u/34844?v=4"},"body":"Junio C Hamano wrote:\n> \"Shawn O. Pearce\" writes:\n> > Junio C Hamano wrote:\n> >> \"Shawn O. Pearce\" writes:\n> >> \n> >> > So why is it legal to omit the tagger header from a tag?\n> >> >\n> >> > E.g. the Linux kernel tag v2.6.12 has no tagger header:\n> >> \n> >> We didn't.add tagger line until c818566 ([PATCH] Update tags to record who\n> >> made them, 2005-07-14), which is v0.99.1~9\n> >> \n> >> Linux 2.6.12 is a lot older than that. v2.6.13-rc4 in late July is the\n> >> first one with tagger.\n> >\n> > Ugh. So its like the 100640 or whatever mode tags in the kernel\n> > trees that are also considered bogus by today's standards, but have\n> > to be allowed because of the kernel history.\n> \n> Yeah; don't we have \"fsck --strict\" or something to take the distinction\n> into account, though? I don't recall if lack of tagger triggers the check\n> offhand and I am too lazy to check.\n\nI don't think it does under --strict. But yea, we do have --strict\nfor the non-kernel repositories.\n\nThis came up because Gerrit Code Review asks JGit to do fsck during\nreceive of objects from a client, JGit's tag fsck is too strict\nand demands a \"tagger \" header, but someone was trying to push this\nold tag from the Linux kernel into an empty repository.\n\nI'll have to relax our tag fsck code in JGit and make the header\noptional.\n\n-- \nShawn.\n"},{"id":"132079","messageId":"20100119064453.GA3946@coredump.intra.peff.net","threadId":"22281","inReplyTo":"20100119060946.GA23212@spearce.org","subject":"Re: why is tagger header optional?","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2010-01-19T06:44:54Z","receivedAt":"2010-01-19T06:44:54Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Mon, Jan 18, 2010 at 10:09:46PM -0800, Shawn O. Pearce wrote:\n\n> So why is it legal to omit the tagger header from a tag?\n> \n> E.g. the Linux kernel tag v2.6.12 has no tagger header:\n\nI think you just answered your own question. We must support tagger-less\ntags because they exist in important projects like the kernel. :)\n\n> [...]\n> Is there a version of Git floating around that doesn't create a\n> tagger header when creating a signed tag? WTF?\n\nEverything prior to c818566 ([PATCH] Update tags to record who made\nthem, 2005-07-14). So probably nothing that anybody is using now, but\nv2.6.12 was one of the first tags made.\n\n> Looking at tag.c's parse_tag_buffer(), the variable sig_line seems\n> to be expected to point at the \"tagger \" header (given its name),\n> but its not actually validated as such.\n\nActually, that variable name predates the patch above, so I suspect\n\"sig\" meant \"GPG signature\". At any rate, as you can see, git doesn't\nverify it, and the code for \"git show v2.6.12\" in\nbuiltin-log.c:show_object handles the taggerless case as well. I don't\nthink anything else actually looks at the tagger. verify-tag treats the\nsigned data as opaque, and just shows the identity of the actual signer.\n\n-Peff\n"}]}