{"thread":{"id":"312","subject":"git \"tag\" objects implemented - and a re-done commit","startedAt":"2005-04-25T19:25:15Z","lastAt":"2005-04-27T15:37:40Z","messageCount":14,"participants":["Linus Torvalds","Andreas Gal","H. Peter Anvin","Petr Baudis","Sean","Ryan Anderson","Matthias Urlichs"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"1644","messageId":"Pine.LNX.4.58.0504251213530.18901@ppc970.osdl.org","threadId":"312","inReplyTo":null,"subject":"git \"tag\" objects implemented - and a re-done commit","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-04-25T19:25:15Z","receivedAt":"2005-04-25T19:25:15Z","isPatch":false,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\nOk, I just pushed out my \"tag\" object implementation, and due to some\nlocal braindamage over here, I ended up re-doing one commit, so if you\nhappened to pull my 'git' tree at _just_ the right time, you will have a\ncommit object named 06a02346f6a2e9ff113c189629ff7148f5141bb0 in your git \nrepository, which is not exactly bogus, but which I ended up undoing.\n\nSo if you've been pulling my git stuff, check your \"git log\" for whether\nyou find that commit in your stuff. If you do, I guess it doesn't much\nmatter (ie should all merge in cleanly), but if you want to match my tree,\nyou should first undo it if it's your HEAD commit (by setting your HEAD to\nthe _parent_ of that commit, and then running the git-prune-script thing).\n\nAnyway, I decided that my original model for tags was the right one, with \na trivial extension. Notably, if you want to tag a single file or a tree \nobject, go wild. The tag object format is:\n\n\tobject <sha1>\n\ttype <type>\n\ttag <tag>\n\t.. free-form commentary and signature of this all ..\n\nand the \"git-mktag\" program verifies that the three first lines are valid \nbefore it accepts it and writes it as a git object.\n\nRight now the tags don't do anything, except fsck can verify them (not the\nsignature - git doesn't even specify any particular format, and you may\nvalidly have unsigned tags in your tree), and will print out something\nlike\n\n\ttagged commit e83c5163316f89bfbde7d9ab23ca2e25604af290 (v2.6.12-rc2)\n\nif you were to have such a tag-object in your object database (you don't, \nbecause I've not generated one, but hey..)\n\n\t\tLinus\n"},{"id":"1648","messageId":"Pine.LNX.4.58.0504251318290.11481@sam.ics.uci.edu","threadId":"312","inReplyTo":"Pine.LNX.4.58.0504251213530.18901@ppc970.osdl.org","subject":"Re: git \"tag\" objects implemented - and a re-done commit","fromName":"Andreas Gal","fromEmail":"gal@uci.edu","sentAt":"2005-04-25T20:23:58Z","receivedAt":"2005-04-25T20:23:58Z","isPatch":false,"sender":{"key":"gal@uci.edu","avatar":null},"body":"\nAre tag objects referenced by trees (and thus limited in scope) or are \nthey stand-alone entities in the repository? The latter would be bad for \nshared object storages. Also, if I delete and recreate tags, will the old \ntag remain in the tree or will the file in the object storage disapear? \nSo far all objects were always persistent, which is a nice property to \nhave.\n\nAndreas\n\nOn Mon, 25 Apr 2005, Linus Torvalds wrote:\n\n> \n> Ok, I just pushed out my \"tag\" object implementation, and due to some\n> local braindamage over here, I ended up re-doing one commit, so if you\n> happened to pull my 'git' tree at _just_ the right time, you will have a\n> commit object named 06a02346f6a2e9ff113c189629ff7148f5141bb0 in your git \n> repository, which is not exactly bogus, but which I ended up undoing.\n> \n> So if you've been pulling my git stuff, check your \"git log\" for whether\n> you find that commit in your stuff. If you do, I guess it doesn't much\n> matter (ie should all merge in cleanly), but if you want to match my tree,\n> you should first undo it if it's your HEAD commit (by setting your HEAD to\n> the _parent_ of that commit, and then running the git-prune-script thing).\n> \n> Anyway, I decided that my original model for tags was the right one, with \n> a trivial extension. Notably, if you want to tag a single file or a tree \n> object, go wild. The tag object format is:\n> \n> \tobject <sha1>\n> \ttype <type>\n> \ttag <tag>\n> \t.. free-form commentary and signature of this all ..\n> \n> and the \"git-mktag\" program verifies that the three first lines are valid \n> before it accepts it and writes it as a git object.\n> \n> Right now the tags don't do anything, except fsck can verify them (not the\n> signature - git doesn't even specify any particular format, and you may\n> validly have unsigned tags in your tree), and will print out something\n> like\n> \n> \ttagged commit e83c5163316f89bfbde7d9ab23ca2e25604af290 (v2.6.12-rc2)\n> \n> if you were to have such a tag-object in your object database (you don't, \n> because I've not generated one, but hey..)\n> \n> \t\tLinus\n> -\n> To unsubscribe from this list: send the line \"unsubscribe git\" in\n> the body of a message to majordomo@vger.kernel.org\n> More majordomo info at  http://vger.kernel.org/majordomo-info.html\n> \n"},{"id":"1649","messageId":"Pine.LNX.4.58.0504251339020.18901@ppc970.osdl.org","threadId":"312","inReplyTo":"Pine.LNX.4.58.0504251318290.11481@sam.ics.uci.edu","subject":"Re: git \"tag\" objects implemented - and a re-done commit","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-04-25T20:42:06Z","receivedAt":"2005-04-25T20:42:06Z","isPatch":false,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\n\nOn Mon, 25 Apr 2005, Andreas Gal wrote:\n> \n> Are tag objects referenced by trees (and thus limited in scope) or are \n> they stand-alone entities in the repository? The latter would be bad for \n> shared object storages.\n\nThey are totally stand-alone, and I don't see why that would be bad for \nshared object storage.\n\nIn fact, the whole point of them is that since they are named by the SHA1 \nhash of the content, there are no shared object issues. Two different tags \nby two different developers will have different names, exactly the same \nway two different releases will have different names.\n\nAnd if two different developers tag exactly the same object with exactly \nthe same tag-name and exactly the same signature, then they get the same \ntag object, and that's fine. They should.\n\n> Also, if I delete and recreate tags, will the old tag remain in the tree\n> or will the file in the object storage disapear?\n\nTags in no way affect the entry they name. When you remove - or add - a\ntag object, nothing happens to anything else.\n\n\t\tLinus\n"},{"id":"1658","messageId":"426D62C0.40104@zytor.com","threadId":"312","inReplyTo":"Pine.LNX.4.58.0504251213530.18901@ppc970.osdl.org","subject":"Re: git \"tag\" objects implemented - and a re-done commit","fromName":"H. Peter Anvin","fromEmail":"hpa@zytor.com","sentAt":"2005-04-25T21:36:00Z","receivedAt":"2005-04-25T21:36:00Z","isPatch":false,"sender":{"key":"hpa@zytor.com","avatar":null},"body":"Linus Torvalds wrote:\n> \n> Anyway, I decided that my original model for tags was the right one, with \n> a trivial extension. Notably, if you want to tag a single file or a tree \n> object, go wild. The tag object format is:\n> \n> \tobject <sha1>\n> \ttype <type>\n> \ttag <tag>\n> \t.. free-form commentary and signature of this all ..\n> \n> and the \"git-mktag\" program verifies that the three first lines are valid \n> before it accepts it and writes it as a git object.\n> \n> Right now the tags don't do anything, except fsck can verify them (not the\n> signature - git doesn't even specify any particular format, and you may\n> validly have unsigned tags in your tree), and will print out something\n> like\n> \n> \ttagged commit e83c5163316f89bfbde7d9ab23ca2e25604af290 (v2.6.12-rc2)\n> \n> if you were to have such a tag-object in your object database (you don't, \n> because I've not generated one, but hey..)\n> \n\nIt would be good if the tag object could permit junk lines before the \nstart of the header; in particular, the standard PGP/GPG signed message \nformat looks like:\n\n-----BEGIN PGP SIGNED MESSAGE-----\n\nobject aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\ntype commit\ntag foo\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.2.6 (GNU/Linux)\n\niQEVAwUBQm1hyWx5eAAqlgcFAQEShgf+P/PNJu5h1uAVPp9+xSy8QtIIC/1Zpl6a\n2Tp22Bw0hfXUNYoJ7O9TH35wttYbcx8ArXl6JhlMIEcV7rS48H/vmTJgtBwnhLSb\nepDPbOriLbCl9E0XXPHqrlmQE07H0iZn2dmLyg2REmtdffi3hjSQIkvFSHy72kOe\nHo6H+s2hzs/u/ypkQ8Cl82Saqn/Drahj9ehdXLRQ5Nsslr71MhwRCD5M0x+0Uy0B\nKPjBiyyx6g/qWzIRLZOdkdbSUdXjczlGnm2wwC6/RdBDjeagDBGafaiuNQH8W3sx\npsfmqKgKZkCBFFlSvwJQAsRFgnVl2vYUAftRaxMnQlCG7COIjNAsdg==\n=lsn0\n-----END PGP SIGNATURE-----\n\nAs an alternative, the signature can be a separate object, since the \nobject SHA-1 itself acts as a verifier of its self-content; thus, all \nthat is really necessary is an authorized verifier.\n\n\t-hpa\n"},{"id":"1660","messageId":"Pine.LNX.4.58.0504251442480.12019@sam.ics.uci.edu","threadId":"312","inReplyTo":"Pine.LNX.4.58.0504251339020.18901@ppc970.osdl.org","subject":"Re: git \"tag\" objects implemented - and a re-done commit","fromName":"Andreas Gal","fromEmail":"gal@uci.edu","sentAt":"2005-04-25T21:46:23Z","receivedAt":"2005-04-25T21:46:23Z","isPatch":false,"sender":{"key":"gal@uci.edu","avatar":null},"body":"\nOk, if tags are standalone objects then I don't see how they get \npropagated. Right now all I need to do to pull a version from a remote \nrepository is to get the commit object and everything it depends on. Any tags \ninvolved would not be pulled as there are no dependencies from the commit \nobject to the tag. Thats why I was asking whether they are part of any \ntree or not.\n\nSo how do we want to do this? Maybe a file TAGS right next to HEAD that \nlists all active tags in my tree by SHA1 hash? Or maybe make tags a linked \nlist, with all tags refering to some parent tag? That would give a nice \nlist to walk back to find older tags (again, we use something like TAG as \nroot).\n\nAndreas\n\nOn Mon, 25 Apr 2005, Linus Torvalds wrote:\n\n> \n> \n> On Mon, 25 Apr 2005, Andreas Gal wrote:\n> > \n> > Are tag objects referenced by trees (and thus limited in scope) or are \n> > they stand-alone entities in the repository? The latter would be bad for \n> > shared object storages.\n> \n> They are totally stand-alone, and I don't see why that would be bad for \n> shared object storage.\n> \n> In fact, the whole point of them is that since they are named by the SHA1 \n> hash of the content, there are no shared object issues. Two different tags \n> by two different developers will have different names, exactly the same \n> way two different releases will have different names.\n> \n> And if two different developers tag exactly the same object with exactly \n> the same tag-name and exactly the same signature, then they get the same \n> tag object, and that's fine. They should.\n> \n> > Also, if I delete and recreate tags, will the old tag remain in the tree\n> > or will the file in the object storage disapear?\n> \n> Tags in no way affect the entry they name. When you remove - or add - a\n> tag object, nothing happens to anything else.\n> \n> \t\tLinus\n> -\n> To unsubscribe from this list: send the line \"unsubscribe git\" in\n> the body of a message to majordomo@vger.kernel.org\n> More majordomo info at  http://vger.kernel.org/majordomo-info.html\n> \n"},{"id":"1664","messageId":"Pine.LNX.4.58.0504251457510.18901@ppc970.osdl.org","threadId":"312","inReplyTo":"426D62C0.40104@zytor.com","subject":"Re: git \"tag\" objects implemented - and a re-done commit","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-04-25T22:05:17Z","receivedAt":"2005-04-25T22:05:17Z","isPatch":false,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\n\nOn Mon, 25 Apr 2005, H. Peter Anvin wrote:\n> \n> It would be good if the tag object could permit junk lines before the \n> start of the header; in particular, the standard PGP/GPG signed message \n> format looks like:\n\nNo, I've already explained why git doesn't parse arbitrary junk: I want \ngit to have 100% repeatable behaviour. And that very much means that if \ngit doesn't understand something, it just doesn't touch it or parse it.\n\nHere's my trivial script to generate tags in proper format. Go wild:\n\n\t#!/bin/sh\n\t( echo -e \"object $(cat .git/HEAD)\\ntype commit\\ntag $1\\n\"; cat ) > .tmp-tag\n\trm -f .tmp-tag.asc\n\tgpg -bsa .tmp-tag && cat .tmp-tag.asc >> .tmp-tag\n\tgit-mktag < .tmp-tag\n\trm -f .tmp-tag*\n\nand it creates objects like this one:\n\n\n\ttorvalds@ppc970:~/git> cat-file tag \n\tba613c023dcd03e06158caee9c0337e6b6988854\n\tobject ec4465adb38d21966acdc9510ff15c0fe4539468\n\ttype commit\n\ttag test-release\n\tTesting tagging\n\t-----BEGIN PGP SIGNATURE-----\n\tVersion: GnuPG v1.2.4 (GNU/Linux)\n\t\n\tiD8DBQBCbVwSF3YsRnbiHLsRAliaAKCMlb6k6VAS7hxajwUtwRdzDZn9rACffVTb\n\tdRdDS6n+pjSAYbA6Lp11bQU=\n\t=JNiv\n\t-----END PGP SIGNATURE-----\n\nand then you just split it at the (last occurrence of) the \n\n\t-----BEGIN PGP SIGNATURE-----\n\nand you can do\n\n\ttorvalds@ppc970:~/git> gpg --verify tag.asc\n\tgpg: Signature made Mon 25 Apr 2005 02:07:30 PM PDT using DSA key ID 76E21CBB\n\tgpg: Good signature from \"Linus Torvalds (tag signing key) <torvalds@osdl.org>\"\n\nto verify the dang thing.\n\nAnd that way git never guesses anything at all, and you can use whatever \nyou want to sign the things.\n\n\t\tLinus\n"},{"id":"1663","messageId":"Pine.LNX.4.58.0504251505260.18901@ppc970.osdl.org","threadId":"312","inReplyTo":"Pine.LNX.4.58.0504251442480.12019@sam.ics.uci.edu","subject":"Re: git \"tag\" objects implemented - and a re-done commit","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-04-25T22:07:17Z","receivedAt":"2005-04-25T22:07:17Z","isPatch":false,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\n\nOn Mon, 25 Apr 2005, Andreas Gal wrote:\n> \n> Ok, if tags are standalone objects then I don't see how they get \n> propagated.\n\nYou propagate them \"by hand\" (which eventually obviously means \"with tools\nto do so\").\n\nThe thing is, you _shouldn't_ be interested in my tags unless I -tell- you \nto be interested in them. \n\nSo I'll probably just push out my tags with my archives, and then people\ncan verify them if they want to.\n\n\t\tLinus\n"},{"id":"1666","messageId":"20050425221810.GM13467@pasky.ji.cz","threadId":"312","inReplyTo":"Pine.LNX.4.58.0504251457510.18901@ppc970.osdl.org","subject":"Re: git \"tag\" objects implemented - and a re-done commit","fromName":"Petr Baudis","fromEmail":"pasky@ucw.cz","sentAt":"2005-04-25T22:18:11Z","receivedAt":"2005-04-25T22:18:11Z","isPatch":false,"sender":{"key":"pasky@ucw.cz","avatar":"https://avatars.githubusercontent.com/u/18439?v=4"},"body":"Dear diary, on Tue, Apr 26, 2005 at 12:05:17AM CEST, I got a letter\nwhere Linus Torvalds <torvalds@osdl.org> told me that...\n> \n> \n> On Mon, 25 Apr 2005, H. Peter Anvin wrote:\n> > \n> > It would be good if the tag object could permit junk lines before the \n> > start of the header; in particular, the standard PGP/GPG signed message \n> > format looks like:\n> \n> No, I've already explained why git doesn't parse arbitrary junk: I want \n> git to have 100% repeatable behaviour. And that very much means that if \n> git doesn't understand something, it just doesn't touch it or parse it.\n> \n> Here's my trivial script to generate tags in proper format. Go wild:\n> \n> \t#!/bin/sh\n> \t( echo -e \"object $(cat .git/HEAD)\\ntype commit\\ntag $1\\n\"; cat ) > .tmp-tag\n> \trm -f .tmp-tag.asc\n> \tgpg -bsa .tmp-tag && cat .tmp-tag.asc >> .tmp-tag\n> \tgit-mktag < .tmp-tag\n> \trm -f .tmp-tag*\n> \n> and it creates objects like this one:\n> \n> \n> \ttorvalds@ppc970:~/git> cat-file tag \n> \tba613c023dcd03e06158caee9c0337e6b6988854\n> \tobject ec4465adb38d21966acdc9510ff15c0fe4539468\n> \ttype commit\n> \ttag test-release\n> \tTesting tagging\n> \t-----BEGIN PGP SIGNATURE-----\n> \tVersion: GnuPG v1.2.4 (GNU/Linux)\n> \t\n> \tiD8DBQBCbVwSF3YsRnbiHLsRAliaAKCMlb6k6VAS7hxajwUtwRdzDZn9rACffVTb\n> \tdRdDS6n+pjSAYbA6Lp11bQU=\n> \t=JNiv\n> \t-----END PGP SIGNATURE-----\n\nCould we please at least maintain the newline between the \"header\" and data,\nlike in the commit objects?\n\nThanks,\n\n-- \n\t\t\t\tPetr \"Pasky\" Baudis\nStuff: http://pasky.or.cz/\nC++: an octopus made by nailing extra legs onto a dog. -- Steve Taylor\n"},{"id":"1671","messageId":"Pine.LNX.4.58.0504251530480.18901@ppc970.osdl.org","threadId":"312","inReplyTo":"Pine.LNX.4.58.0504251505260.18901@ppc970.osdl.org","subject":"Re: git \"tag\" objects implemented - and a re-done commit","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-04-25T22:39:29Z","receivedAt":"2005-04-25T22:39:29Z","isPatch":false,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\n\nOn Mon, 25 Apr 2005, Linus Torvalds wrote:\n> \n> So I'll probably just push out my tags with my archives, and then people\n> can verify them if they want to.\n\nOk, for the intrepid users, you can now test to see if you can pick them \nout. fsck should make them totally obvious, and here's my public key in \ncase you also want to verify the things.\n\nOf course, since I normally don't use pgp signing etc, it's entirely \npossible that I've done something stupid, and I'm now sending you my \nsecret key and my full porn-collection.\n\n\t\tLinus\n\n-----BEGIN PGP PUBLIC KEY BLOCK-----\nVersion: GnuPG v1.2.4 (GNU/Linux)\n\nmQGiBEJqZ4sRBADKttqQOCAxRzz5qGmo5QnSR5GTkSlPTm4lCuaVUon0qQPNrasr\ncSBAOJ1MlXjhbRPrN3pAhI+taLgrWQ231zUNHxCTmWJZV3Yzxr8xJQGlfHlVOxXB\nLI42tAfCjHOF7z8pPj6AGhtE2+fzq1U3mOlA/fUG4uYDOwIoPK+qgbM6SwCgulqs\nDGlQKFFtFgW8HVnDftFmyZMD+wc0E9jRa9HJ3b1U3vY1jrxpoVw5QeeIZdSRnRFy\nsknOHca5mlJvTidu1cs7xCuvpufw1VIVvgf4tPwXcTDEKthYEhoty+DFOqZ9R7pg\nEMhjYbq+Q8yLT3OWQtUKV4B10FRYIWidnJ8y2CjLduTmB+cyj976oxEY/llLBbQM\nyuDrBADDLw/3KZL5D75icA0l/uebQ6/73j8jcRoVu0gTqAdQBYL6Zv7Y0G7xHUCo\nEqgo+p2LXAeU9IoeA5/h8SNVDw4fYoqo6VQTkr+ydegHkjwlbrhOL/gxzlY1Pde1\nTBi6+QCUssk0FCPMALt7M+OgFpSKx7pP2xSsDsMvvNNAmLl0JrQ0TGludXMgVG9y\ndmFsZHMgKHRhZyBzaWduaW5nIGtleSkgPHRvcnZhbGRzQG9zZGwub3JnPoheBBMR\nAgAeBQJCameLAhsDBgsJCAcDAgMVAgMDFgIBAh4BAheAAAoJEBd2LEZ24hy7I84A\nnROHRYes4RU8btdleR0TgwJG7jMvAKCF2CingjxaC4sTL7BkFfNacTkBYLkBDQRC\nameMEAQAlJiw0IBltu5ihEXE4mFYiWHuVAoeufVJ9fONv67y6fu3efJ10PJ7AQdG\nUfez+8yxkrahyIVC77NuQLDrRfvgmrJ8sbP8xb6QEbY1bnwLeuciTolGjL+kYi17\nJ74iG2cQDyimnLWJm5lNqeUOz3nTW429SyLCRhXpR1lUjijiVi8AAwcD/1f4VEql\nu9HHTA4S+1aoOQV5guZCr6JbYdWkAZeeFRpFSXfCae6uO8DhpD7o/8kiK3O8qP1O\nyjQF0bG26iLCm8MdJCO0WQ2xsVlwrrvnNPpgRgbirOgoxHM4ESq/YV+MqXo41Hm0\nilHRM7OIbmm7uvFSlUJmUasuJRsrhibilbvNiEkEGBECAAkFAkJqZ4wCGwwACgkQ\nF3YsRnbiHLsolQCfRVImDkgijhPGmwyI7T19bWltXwsAniMi9gakkN+9DT8E5kli\ne8uTEk8f\n=PRrZ\n-----END PGP PUBLIC KEY BLOCK-----\n\n"},{"id":"1672","messageId":"Pine.LNX.4.58.0504251539450.18901@ppc970.osdl.org","threadId":"312","inReplyTo":"20050425221810.GM13467@pasky.ji.cz","subject":"Re: git \"tag\" objects implemented - and a re-done commit","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-04-25T22:41:00Z","receivedAt":"2005-04-25T22:41:00Z","isPatch":false,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\n\nOn Tue, 26 Apr 2005, Petr Baudis wrote:\n> \n> Could we please at least maintain the newline between the \"header\" and data,\n> like in the commit objects?\n\nYes, I did that in the \"git-tag-script\" I actually committed, although git \ndoesn't currently really care (ie fsck won't complain).\n\n\t\tLinus\n"},{"id":"1696","messageId":"1524.10.10.10.24.1114483485.squirrel@linux1","threadId":"312","inReplyTo":"Pine.LNX.4.58.0504251530480.18901@ppc970.osdl.org","subject":"Re: git \"tag\" objects implemented - and a re-done commit","fromName":"Sean","fromEmail":"seanlkml@sympatico.ca","sentAt":"2005-04-26T02:44:45Z","receivedAt":"2005-04-26T02:44:45Z","isPatch":false,"sender":{"key":"seanlkml@sympatico.ca","avatar":"https://gravatar.com/avatar/f92923f54fc08c401fc59b71829d4b89e9b8087fbba45ff87c82e6a83aee02ae?d=mp&s=160"},"body":"On Mon, April 25, 2005 6:39 pm, Linus Torvalds said:\n>\n> Ok, for the intrepid users, you can now test to see if you can pick them\nout. fsck should make them totally obvious, and here's my public key in\ncase you also want to verify the things.\n>\n> Of course, since I normally don't use pgp signing etc, it's entirely\npossible that I've done something stupid, and I'm now sending you my\nsecret key and my full porn-collection.\n>\n\n\nLinus,\n\nLooks good:\n\n$ gpg --import torvalds.pgp\n$ gpg --edit-key Linus trust\ngpg --edit-key Linus trust\n 1 = Don't know\n 2 = I do NOT trust\n 3 = I trust marginally\n 4 = I trust fully\n 5 = I trust ultimately\n m = back to the main menu\n\nYour decision? 5\nDo you really want to set this key to ultimate trust? y\n\n\n\n$ fsck-cache  --tags\ntagged commit a2755a80f40e5794ddc20e00f781af9d6320fafb (v2.6.12-rc3) in\n0397236d43e48e821cce5bbe6a80a1a56bb7cc3a\ntagged commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (v2.6.12-rc2) in\n9e734775f7c22d2f89943ad6c745571f1930105f\nexpect dangling commits - potential heads - due to lack of head\ninformation\ndangling commit b453257f057b834fdf9f4a6ad6133598b79bd982\n\n\n\n$ chksig.sh 0397236d43e48e821cce5bbe6a80a1a56bb7cc3a\ngpg: Signature made Mon Apr 25 18:27:55 2005 EDT using DSA key ID 76E21CBB\ngpg: Good signature from \"Linus Torvalds (tag signing key)\n<torvalds@osdl.org>\"\n\n\n\nchksig.sh:\n\n#!/bin/sh\nTAG=$1\ncat-file tag $TAG | sed -ne '/BEGIN PGP/,/END PGP/p' > .tmp.sig\ncat-file tag $TAG | sed -e '/BEGIN PGP/,/END PGP/d' | \\\n        gpg --verify .tmp.sig -\nrm -f .tmp.sig\n\n\n\nSean\n\n\n\n\n"},{"id":"1715","messageId":"1114494906.5983.23.camel@mythical","threadId":"312","inReplyTo":"Pine.LNX.4.58.0504251530480.18901@ppc970.osdl.org","subject":"Re: git \"tag\" objects implemented - and a re-done commit","fromName":"Ryan Anderson","fromEmail":"ryan@michonline.com","sentAt":"2005-04-26T05:55:06Z","receivedAt":"2005-04-26T05:55:06Z","isPatch":false,"sender":{"key":"ryan@michonline.com","avatar":null},"body":"On Mon, 2005-04-25 at 15:39 -0700, Linus Torvalds wrote:\n> \n> On Mon, 25 Apr 2005, Linus Torvalds wrote:\n> > \n> > So I'll probably just push out my tags with my archives, and then people\n> > can verify them if they want to.\n> \n> Ok, for the intrepid users, you can now test to see if you can pick them \n> out. fsck should make them totally obvious, and here's my public key in \n> case you also want to verify the things.\n> \n> Of course, since I normally don't use pgp signing etc, it's entirely \n> possible that I've done something stupid, and I'm now sending you my \n> secret key and my full porn-collection.\n\n(Un?)fortunately, you appear to have done it correctly.\n\nNow, you just need to get a few people that know for certain it's really\nyour key to sign it and upload the signatures to the key server, and it\nwould be golden.\n\n-- \nRyan Anderson <ryan@michonline.com>\n"},{"id":"1843","messageId":"pan.2005.04.27.03.36.51.65390@smurf.noris.de","threadId":"312","inReplyTo":"Pine.LNX.4.58.0504251339020.18901@ppc970.osdl.org","subject":"Re: git \"tag\" objects implemented - and a re-done commit","fromName":"Matthias Urlichs","fromEmail":"smurf@smurf.noris.de","sentAt":"2005-04-27T03:36:51Z","receivedAt":"2005-04-27T03:36:51Z","isPatch":false,"sender":{"key":"matthias@urlichs.de","avatar":"https://gravatar.com/avatar/2708905af227313eba6f2b2ae0f7d0259b5ac5d71baef58fe5a13c699ce0bbf0?d=mp&s=160"},"body":"Hi, Linus Torvalds wrote:\n\n> And if two different developers tag exactly the same object with exactly \n> the same tag-name and exactly the same signature, then they get the same \n> tag object, and that's fine. They should.\n\n... except that they can't. I mean, the signature is done by different\npeople at different times, so it can't well be identical.\n\n-- \nMatthias Urlichs\n\n"},{"id":"1868","messageId":"Pine.LNX.4.58.0504270833210.18901@ppc970.osdl.org","threadId":"312","inReplyTo":"pan.2005.04.27.03.36.51.65390@smurf.noris.de","subject":"Re: git \"tag\" objects implemented - and a re-done commit","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-04-27T15:37:40Z","receivedAt":"2005-04-27T15:37:40Z","isPatch":false,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\n\nOn Wed, 27 Apr 2005, Matthias Urlichs wrote:\n>\n> Hi, Linus Torvalds wrote:\n> \n> > And if two different developers tag exactly the same object with exactly \n> > the same tag-name and exactly the same signature, then they get the same \n> > tag object, and that's fine. They should.\n> \n> ... except that they can't. I mean, the signature is done by different\n> people at different times, so it can't well be identical.\n\nYou'd quite possibly use some shared secret key for some work. For \nexample, say you're a company, and any \"release person\" can sign the \nwork..\n\nAlso, since you can tag things without signing anything at all, it's even \nmore trivial to get the same tag that way.\n\nSigning tags really makes sense when you want somebody _else_ to trust it. \nBut unsigned tags are perfectly practical from a _private_ perspective: \nlet's say that you just want to remember certain events but you don't need \nto tell anybody else about them - what you'd do is to just create your own \nlocal tag, and there's no real reason to sign it, since you'll never tell \nanybody else about it anyway.\n\n(One such thing could be to create a tag every time you compile and\ninstall a new kernel: your \"tag\" is just a way to remember what your\ninstalled kernel was built against, and is meaningless to anybody else.  \nIn fact, you might well decide to just remove such tags periodically).\n\n\t\tLinus\n"}]}