{"thread":{"id":"37782","subject":"[PATCH 0/2] document signature formats","startedAt":"2014-10-22T15:16:52Z","lastAt":"2014-10-30T10:19:18Z","messageCount":9,"participants":["Michael J Gruber","Jakub Narębski","Junio C Hamano"],"isPatch":true,"patchVersion":1,"patchTotal":2},"messages":[{"id":"250966","messageId":"cover.1413990838.git.git@drmicha.warpmail.net","threadId":"37782","inReplyTo":null,"subject":"[PATCH 0/2] document signature formats","fromName":"Michael J Gruber","fromEmail":"git@drmicha.warpmail.net","sentAt":"2014-10-22T15:16:52Z","receivedAt":"2014-10-22T15:16:52Z","isPatch":true,"sender":{"key":"git@grubix.eu","avatar":"https://avatars.githubusercontent.com/u/233215?v=4"},"body":"This is a first shot at documenting the various signatures that we use\nin a technical document. If something like this is deemed useful\nI should probably recreate the sample signatures using our testlib\nkeys and users in a v2.\n\nMichael J Gruber (2):\n Documentation/technical: signature formats\n Documentation/technical: document push certificate format\n\n Documentation/Makefile | 1 +\n Documentation/technical/signature-format.txt | 161 +++++++++++++++++++++++++++\n 2 files changed, 162 insertions(+)\n create mode 100644 Documentation/technical/signature-format.txt\n\n-- \n2.1.2.756.gfa53a0a\n"},{"id":"250967","messageId":"13b090185cb5a36cddf8c1ba4fcd6fe52e109084.1413990838.git.git@drmicha.warpmail.net","threadId":"37782","inReplyTo":"cover.1413990838.git.git@drmicha.warpmail.net","subject":"[PATCH 1/2] Documentation/technical: signature formats","fromName":"Michael J Gruber","fromEmail":"git@drmicha.warpmail.net","sentAt":"2014-10-22T15:16:53Z","receivedAt":"2014-10-22T15:16:53Z","isPatch":true,"sender":{"key":"git@grubix.eu","avatar":"https://avatars.githubusercontent.com/u/233215?v=4"},"body":"Various formats for storing signatures have accumulated by now.\nDocument them to keep track (and maybe avoid yet another one).\n\nSigned-off-by: Michael J Gruber \n---\n Documentation/Makefile | 1 +\n Documentation/technical/signature-format.txt | 126 +++++++++++++++++++++++++++\n 2 files changed, 127 insertions(+)\n create mode 100644 Documentation/technical/signature-format.txt\n\ndiff --git a/Documentation/Makefile b/Documentation/Makefile\nindex cea0e7a..2638c0c 100644\n--- a/Documentation/Makefile\n+++ b/Documentation/Makefile\n@@ -74,6 +74,7 @@ TECH_DOCS += technical/protocol-common\n TECH_DOCS += technical/racy-git\n TECH_DOCS += technical/send-pack-pipeline\n TECH_DOCS += technical/shallow\n+TECH_DOCS += technical/signature-format\n TECH_DOCS += technical/trivial-merge\n SP_ARTICLES += $(TECH_DOCS)\n SP_ARTICLES += technical/api-index\ndiff --git a/Documentation/technical/signature-format.txt b/Documentation/technical/signature-format.txt\nnew file mode 100644\nindex 0000000..80f0a47\n--- /dev/null\n+++ b/Documentation/technical/signature-format.txt\n@@ -0,0 +1,126 @@\n+Git signature format\n+====================\n+\n+== Overview\n+\n+Git uses cryptographic signatures in various places, currently\n+objects (tags, commits, mergetags) and transactions (pushes).\n+In every case, the command which is about to create an object or\n+transaction determines a payload from that, calls gpg to obtain\n+a detached signature for the payload and embeds the signature\n+into the object or transaction.\n+\n+Signatures always begin with `-----BEGIN PGP SIGNATURE-----`\n+and end with `-----END PGP SIGNATURE-----`.\n+\n+== Tag signatures\n+\n+- created by: `git tag -s`\n+- payload: annotated tag object\n+- embedding: append the signature to the tag object\n+- example: tag `stag` with tag message `tagmess`\n+\n+----\n+object 8cbad082a020b7d4ef729b14e1a654c4f60791c6\n+type commit\n+tag stag\n+tagger Michael J Gruber 1351067460 +0200\n+\n+tagmess\n+-----BEGIN PGP SIGNATURE-----\n+Version: GnuPG v1.4.12 (GNU/Linux)\n+\n+iQIcBAABCgAGBQJQh6dPAAoJELR76rQkz552ZBEP/3vkpftZnhsUkGhqXXptnRhz\n+5A3n+BqFTsh4d4C15lcRcevwTyyQF61vrFKFRE7Cl5XVqVHowW0al+Dx7j5p35Mz\n+PqBZUbEkBFc9xY8WasQYbJl5yDboc8Ora71SEJ1k59duETXmZ67ISpEe6HF3d2xK\n+3BGfqaBMwU+Aql0pDMtysoOgEgs7d/Vin9gIXJcqAvw71bpNyZvFUln3do2eLC/v\n+VW0bVvAN3B66fLx3li8hEZ4wfrg0Uui5zSN95+uc2DUGW03BNR/sKhYXstHAoqef\n+4WIAD70e+9vArh8WqPTIUWl0w+1ixgVvGckHXHW10MdwkoVtwo4tawRxngLBKuI9\n+pUu7dc/TIVl15z/y1EmQ25rB4WV9M9W+uRauUi/T3c0hfSuZkB6B1tCu3QStPbWz\n+AK3O6Neoni2NgMDLmrWzgDZA3Z/+h9RBV/kNda0RpbWZYJOJILBR+Q8+BZOwDZX/\n+hu/tITC7IHVJgMXYGlEFybEn/clbtLsZr8zLlSZyropl0mvUBLeBCrjYBQuDN86g\n+yew/Tzs9T5MEFagUkbRERz5rP5OIE9XpXcHMsZve7cCL3YQy0LOkZk3RZKUsbv8g\n+MVU1px5/ImBkr0MU0XZxstsAV0YPiON3+qMOnrdGuFx11YQi6cmIA2eww2KPqzHY\n+YKirAGNintaD8yXAlwLd\n+=wF8p\n+-----END PGP SIGNATURE-----\n+----\n+\n+== Commit signature\n+\n+- created by: `git commit -s`\n+- payload: commit object\n+- embedding: header entry `gpgsig`\n+ (content is preceded by a space)\n+- example: commit with commit message `sigtest`\n+\n+----\n+tree 14461762125c079e55a9684ae3a96e27de5b3f2f\n+parent da19995926ec89e48297a3163b0f5190af3a8650\n+author Michael J Gruber 1325088101 +0100\n+committer Michael J Gruber 1325088101 +0100\n+gpgsig -----BEGIN PGP SIGNATURE-----\n+ Version: GnuPG v1.4.11 (GNU/Linux)\n+ \n+ iQIcBAABCgAGBQJO+z1lAAoJELR76rQkz552xOoQAJgV6sstR8cge760X7awb00V\n+ svN+pcc1TtJZecYWakCIe6dGPAK2Yk1AwExV0tbAQskPxYIqwnuysXHvVlmyJh5P\n+ 1N033YSRc8j59YNQNaLIAh6+c59cKcZdWQyrA1HFVWGqoafCD2+nMglb/JbN9jqQ\n+ 5gsxfFGoE0blT+BnMrchzPL4kjMJQBszV5ccATu3iIgSv23p5rA4tm3/P44enIsH\n+ U9nYODlKmzsAulThQoSd4Qk0MNIg86MjIXanPkj4S+TLLgDa6Zf8W3m28IiRwPF1\n+ WemWpQ9VwSSHKuGVyHGG2OErtDDftILcYtjW5c/UnLw38hWPwc+KxVmAdEBY3vgk\n+ OACDEDLqAWgc4rLdWgkoxieIi0aKN+iN4kogbEtSl4VzgvX0iGLZP8cyJnGxHria\n+ Qz2UcesNqVPPqOxsIJKpr3CByrh2WDzH8W3tvGuy5q8EsTx5uF1HGoYb3PIx76QG\n+ 3ClhL5Wtjk3/iQnycWo60eKMJccLbv+uoXzUP3LA0prt0K3a+52pWVppt8RW1L6u\n+ kALJjsc44gr04v/fo5x6zkgFFt+8e/YWDZO+vwCJDmCyqggEvA5dj6i0y2B+hZjL\n+ RVG0RATLroPgMa6oHSEVEbP+Ui4JZ3k3fRLIOupb0qjHtv/cvB7kcXevpdQUFGs0\n+ 6kmaMJBcWutA6HrosuP/\n+ =9PhX\n+ -----END PGP SIGNATURE-----\n+\n+sigtest\n+----\n+\n+== Mergetag signature\n+\n+- created by: `git merge` on signed tag\n+- payload/embedding: the whole signed tag object is embedded into\n+ the (merge) commit object of header entry `mergetag`\n+- example: merge of the signed tag `stag` as above\n+\n+----\n+tree ceb2177fea91ec9369e012dbe794419ee0731ce7\n+parent 9c20ba82367dab0fe4789e2be400a7fb0c447c34\n+parent 8cbad082a020b7d4ef729b14e1a654c4f60791c6\n+author Michael J Gruber 1412951117 +0200\n+committer Michael J Gruber 1412951117 +0200\n+mergetag object 8cbad082a020b7d4ef729b14e1a654c4f60791c6\n+ type commit\n+ tag stag\n+ tagger Michael J Gruber 1351067460 +0200\n+ \n+ tagmess\n+ -----BEGIN PGP SIGNATURE-----\n+ Version: GnuPG v1.4.12 (GNU/Linux)\n+ \n+ iQIcBAABCgAGBQJQh6dPAAoJELR76rQkz552ZBEP/3vkpftZnhsUkGhqXXptnRhz\n+ 5A3n+BqFTsh4d4C15lcRcevwTyyQF61vrFKFRE7Cl5XVqVHowW0al+Dx7j5p35Mz\n+ PqBZUbEkBFc9xY8WasQYbJl5yDboc8Ora71SEJ1k59duETXmZ67ISpEe6HF3d2xK\n+ 3BGfqaBMwU+Aql0pDMtysoOgEgs7d/Vin9gIXJcqAvw71bpNyZvFUln3do2eLC/v\n+ VW0bVvAN3B66fLx3li8hEZ4wfrg0Uui5zSN95+uc2DUGW03BNR/sKhYXstHAoqef\n+ 4WIAD70e+9vArh8WqPTIUWl0w+1ixgVvGckHXHW10MdwkoVtwo4tawRxngLBKuI9\n+ pUu7dc/TIVl15z/y1EmQ25rB4WV9M9W+uRauUi/T3c0hfSuZkB6B1tCu3QStPbWz\n+ AK3O6Neoni2NgMDLmrWzgDZA3Z/+h9RBV/kNda0RpbWZYJOJILBR+Q8+BZOwDZX/\n+ hu/tITC7IHVJgMXYGlEFybEn/clbtLsZr8zLlSZyropl0mvUBLeBCrjYBQuDN86g\n+ yew/Tzs9T5MEFagUkbRERz5rP5OIE9XpXcHMsZve7cCL3YQy0LOkZk3RZKUsbv8g\n+ MVU1px5/ImBkr0MU0XZxstsAV0YPiON3+qMOnrdGuFx11YQi6cmIA2eww2KPqzHY\n+ YKirAGNintaD8yXAlwLd\n+ =wF8p\n+ -----END PGP SIGNATURE-----\n+\n+Merge tag 'stag' into HEAD\n+\n+tagmess\n+\n+Conflicts:\n+\t...\n+----\n-- \n2.1.2.756.gfa53a0a\n"},{"id":"250968","messageId":"31c4690b88947ff146f4e207a5ee159fd3010465.1413990838.git.git@drmicha.warpmail.net","threadId":"37782","inReplyTo":"cover.1413990838.git.git@drmicha.warpmail.net","subject":"[PATCH 2/2] Documentation/technical: document push certificate format","fromName":"Michael J Gruber","fromEmail":"git@drmicha.warpmail.net","sentAt":"2014-10-22T15:16:54Z","receivedAt":"2014-10-22T15:16:54Z","isPatch":true,"sender":{"key":"git@grubix.eu","avatar":"https://avatars.githubusercontent.com/u/233215?v=4"},"body":"Signed-off-by: Michael J Gruber \n---\n Documentation/technical/signature-format.txt | 35 ++++++++++++++++++++++++++++\n 1 file changed, 35 insertions(+)\n\ndiff --git a/Documentation/technical/signature-format.txt b/Documentation/technical/signature-format.txt\nindex 80f0a47..49c2c82 100644\n--- a/Documentation/technical/signature-format.txt\n+++ b/Documentation/technical/signature-format.txt\n@@ -124,3 +124,38 @@ tagmess\n Conflicts:\n \t...\n ----\n+\n+== Push certificate\n+\n+- created by: `git push --signed`\n+- payload: a push certificate header followed by the push transcript\n+ (see pack-protocol.txt)\n+- embedding: append the signature to the push transcript\n+- example: push of commit `21723` updating `master` on `localhost`\n+ from `45cfe`\n+\n+----\n+certificate version 0.1\n+pusher Michael J Gruber 1413979846 +0200\n+pushee localhost:/tmp/t/a\n+nonce 1413979846-48813c0bc9d3b598d71d\n+\n+45cfec8735b7842a32dcc092a14850aa6220ef33 217230e5793407fc7c099117011ed13143fece63 refs/heads/master\n+-----BEGIN PGP SIGNATURE-----\n+Version: GnuPG v1\n+\n+iQIcBAABCgAGBQJUR57GAAoJELR76rQkz552EWMP/3yHaFYuG3T/FcshgXQubsml\n+t4TvkegjQFtVK31oedqaAQGJYusXX2/yUFviXpRq611Aj7rooBnpZYZKT5lUm/ol\n+m9KjDvFpOiY7rA/y6BBetSX6s6uhmO4WcgJ4hSsMZ4z+001y2zawxWm0cedurIcO\n+hpKbAmQ/EiMmQiA4D9vKmLJUXpzF63NzMElZfWzHLa0IU1ZN6EvH1l+N7ulBNsuv\n+lTh3UxjabJr4vpu6kwMquCGqRB60+rdG7itiHwRQynnmDhvXoQxtU9gtLymXKJIS\n+SGQ5v3B5hsGA2LkCCkvNj+QRLH9LF8iAZqezqGA5U/Cg7xckOPlMwFllTv8goDBW\n+IB7Mk5lpQqaUCZf33uIppiEtHipLpGI90NLCm+JvzrNnnseSS6jARVRMx6cWp+dB\n+9QTCq80mRI/zzcvDyPhNvj0tP3mUTFmR4+KRh+4zRq9iOGp5KpJrpFjndCQELwAW\n+402hXEEjB4Kq7KSU4jEoaYGrJR9KJmPmgWHvz2GaJZ5eCJIXuoLGZo3TtxXRHB9p\n+EqWp3iZOZotxZmUVHgohFhqxZgcAefdfzZUqQ8jY3hHvu5Zwd2muToc8Nh/vIHoB\n+us0NHUiI8TOccAHd8AIrqgoXj2gChr3cQxWNcfBfx+ALT8sEtNrVkkrovmRiMEa4\n+MxEdQTwhooEE8PWD5Yj5\n+=6MAR\n+-----END PGP SIGNATURE-----\n+----\n-- \n2.1.2.756.gfa53a0a\n"},{"id":"250969","messageId":"5447E1DE.2040601@gmail.com","threadId":"37782","inReplyTo":"13b090185cb5a36cddf8c1ba4fcd6fe52e109084.1413990838.git.git@drmicha.warpmail.net","subject":"Re: [PATCH 1/2] Documentation/technical: signature formats","fromName":"Jakub Narębski","fromEmail":"jnareb@gmail.com","sentAt":"2014-10-22T16:57:02Z","receivedAt":"2014-10-22T16:57:02Z","isPatch":true,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"W dniu 2014-10-22 17:16, Michael J Gruber napisał:\n\n> +== Commit signature\n> +\n> +- created by: `git commit -s`\n> +- payload: commit object\n> +- embedding: header entry `gpgsig`\n> + (content is preceded by a space)\n> +- example: commit with commit message `sigtest`\n\nActually it is not \"content is preceded by space\", but it is\nmulti-line header which uses RFC-2822 like wrapping (see \"Long\nHeader Fields\" there) - leading space means wrapped in email,\nseparate line here.\n\nNice work.\n-- \nJakub Narębski\n"},{"id":"250973","messageId":"xmqq7fzshqrb.fsf@gitster.dls.corp.google.com","threadId":"37782","inReplyTo":"13b090185cb5a36cddf8c1ba4fcd6fe52e109084.1413990838.git.git@drmicha.warpmail.net","subject":"Re: [PATCH 1/2] Documentation/technical: signature formats","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2014-10-22T19:02:32Z","receivedAt":"2014-10-22T19:02:32Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Michael J Gruber writes:\n\n> Various formats for storing signatures have accumulated by now.\n> Document them to keep track (and maybe avoid yet another one).\n\nI haven't looked at the description closely, but it is a good thing\nto describe signature in a tag and in a commit in detail, which we\nfailed to do so far.\n\nThe principle is essentially the same between the signature on a tag\nand on a commit: a detached PGP signature over the remainder of the\nobject data is created, and then the signature is inserted into an\nappropriate place in the resulting object. That \"appropriate place\"\nis influenced by the type and nature of the object.\n\nA mergetag is not fundamentally a \"signature\" in the above sense,\nthough. It is just a dump of the object content in a regular object\nheader field (hence indented by one SP), and its contents having PGP\nSIGNATURE is merely a natural consequence of the object recorded\nbeing a signed tag. So the description of it in the same place as\ndescription for signed tags and signed commits feels a little bit\nout of place, but I do not think of a better place to describe it.\n\nThanks.\n\n> Signed-off-by: Michael J Gruber \n> ---\n> Documentation/Makefile | 1 +\n> Documentation/technical/signature-format.txt | 126 +++++++++++++++++++++++++++\n> 2 files changed, 127 insertions(+)\n> create mode 100644 Documentation/technical/signature-format.txt\n>\n> diff --git a/Documentation/Makefile b/Documentation/Makefile\n> index cea0e7a..2638c0c 100644\n> --- a/Documentation/Makefile\n> +++ b/Documentation/Makefile\n> @@ -74,6 +74,7 @@ TECH_DOCS += technical/protocol-common\n> TECH_DOCS += technical/racy-git\n> TECH_DOCS += technical/send-pack-pipeline\n> TECH_DOCS += technical/shallow\n> +TECH_DOCS += technical/signature-format\n> TECH_DOCS += technical/trivial-merge\n> SP_ARTICLES += $(TECH_DOCS)\n> SP_ARTICLES += technical/api-index\n> diff --git a/Documentation/technical/signature-format.txt\n> b/Documentation/technical/signature-format.txt\n> new file mode 100644\n> index 0000000..80f0a47\n> --- /dev/null\n> +++ b/Documentation/technical/signature-format.txt\n> @@ -0,0 +1,126 @@\n> +Git signature format\n> +====================\n> +\n> +== Overview\n> +\n> +Git uses cryptographic signatures in various places, currently\n> +objects (tags, commits, mergetags) and transactions (pushes).\n> +In every case, the command which is about to create an object or\n> +transaction determines a payload from that, calls gpg to obtain\n> +a detached signature for the payload and embeds the signature\n> +into the object or transaction.\n> +\n> +Signatures always begin with `-----BEGIN PGP SIGNATURE-----`\n> +and end with `-----END PGP SIGNATURE-----`.\n> +\n> +== Tag signatures\n> +\n> +- created by: `git tag -s`\n> +- payload: annotated tag object\n> +- embedding: append the signature to the tag object\n> +- example: tag `stag` with tag message `tagmess`\n> +\n> +----\n> +object 8cbad082a020b7d4ef729b14e1a654c4f60791c6\n> +type commit\n> +tag stag\n> +tagger Michael J Gruber 1351067460 +0200\n> +\n> +tagmess\n> +-----BEGIN PGP SIGNATURE-----\n> +Version: GnuPG v1.4.12 (GNU/Linux)\n> +\n> +iQIcBAABCgAGBQJQh6dPAAoJELR76rQkz552ZBEP/3vkpftZnhsUkGhqXXptnRhz\n> +5A3n+BqFTsh4d4C15lcRcevwTyyQF61vrFKFRE7Cl5XVqVHowW0al+Dx7j5p35Mz\n> +PqBZUbEkBFc9xY8WasQYbJl5yDboc8Ora71SEJ1k59duETXmZ67ISpEe6HF3d2xK\n> +3BGfqaBMwU+Aql0pDMtysoOgEgs7d/Vin9gIXJcqAvw71bpNyZvFUln3do2eLC/v\n> +VW0bVvAN3B66fLx3li8hEZ4wfrg0Uui5zSN95+uc2DUGW03BNR/sKhYXstHAoqef\n> +4WIAD70e+9vArh8WqPTIUWl0w+1ixgVvGckHXHW10MdwkoVtwo4tawRxngLBKuI9\n> +pUu7dc/TIVl15z/y1EmQ25rB4WV9M9W+uRauUi/T3c0hfSuZkB6B1tCu3QStPbWz\n> +AK3O6Neoni2NgMDLmrWzgDZA3Z/+h9RBV/kNda0RpbWZYJOJILBR+Q8+BZOwDZX/\n> +hu/tITC7IHVJgMXYGlEFybEn/clbtLsZr8zLlSZyropl0mvUBLeBCrjYBQuDN86g\n> +yew/Tzs9T5MEFagUkbRERz5rP5OIE9XpXcHMsZve7cCL3YQy0LOkZk3RZKUsbv8g\n> +MVU1px5/ImBkr0MU0XZxstsAV0YPiON3+qMOnrdGuFx11YQi6cmIA2eww2KPqzHY\n> +YKirAGNintaD8yXAlwLd\n> +=wF8p\n> +-----END PGP SIGNATURE-----\n> +----\n> +\n> +== Commit signature\n> +\n> +- created by: `git commit -s`\n> +- payload: commit object\n> +- embedding: header entry `gpgsig`\n> + (content is preceded by a space)\n> +- example: commit with commit message `sigtest`\n> +\n> +----\n> +tree 14461762125c079e55a9684ae3a96e27de5b3f2f\n> +parent da19995926ec89e48297a3163b0f5190af3a8650\n> +author Michael J Gruber 1325088101 +0100\n> +committer Michael J Gruber 1325088101 +0100\n> +gpgsig -----BEGIN PGP SIGNATURE-----\n> + Version: GnuPG v1.4.11 (GNU/Linux)\n> + \n> + iQIcBAABCgAGBQJO+z1lAAoJELR76rQkz552xOoQAJgV6sstR8cge760X7awb00V\n> + svN+pcc1TtJZecYWakCIe6dGPAK2Yk1AwExV0tbAQskPxYIqwnuysXHvVlmyJh5P\n> + 1N033YSRc8j59YNQNaLIAh6+c59cKcZdWQyrA1HFVWGqoafCD2+nMglb/JbN9jqQ\n> + 5gsxfFGoE0blT+BnMrchzPL4kjMJQBszV5ccATu3iIgSv23p5rA4tm3/P44enIsH\n> + U9nYODlKmzsAulThQoSd4Qk0MNIg86MjIXanPkj4S+TLLgDa6Zf8W3m28IiRwPF1\n> + WemWpQ9VwSSHKuGVyHGG2OErtDDftILcYtjW5c/UnLw38hWPwc+KxVmAdEBY3vgk\n> + OACDEDLqAWgc4rLdWgkoxieIi0aKN+iN4kogbEtSl4VzgvX0iGLZP8cyJnGxHria\n> + Qz2UcesNqVPPqOxsIJKpr3CByrh2WDzH8W3tvGuy5q8EsTx5uF1HGoYb3PIx76QG\n> + 3ClhL5Wtjk3/iQnycWo60eKMJccLbv+uoXzUP3LA0prt0K3a+52pWVppt8RW1L6u\n> + kALJjsc44gr04v/fo5x6zkgFFt+8e/YWDZO+vwCJDmCyqggEvA5dj6i0y2B+hZjL\n> + RVG0RATLroPgMa6oHSEVEbP+Ui4JZ3k3fRLIOupb0qjHtv/cvB7kcXevpdQUFGs0\n> + 6kmaMJBcWutA6HrosuP/\n> + =9PhX\n> + -----END PGP SIGNATURE-----\n> +\n> +sigtest\n> +----\n> +\n> +== Mergetag signature\n> +\n> +- created by: `git merge` on signed tag\n> +- payload/embedding: the whole signed tag object is embedded into\n> + the (merge) commit object of header entry `mergetag`\n> +- example: merge of the signed tag `stag` as above\n> +\n> +----\n> +tree ceb2177fea91ec9369e012dbe794419ee0731ce7\n> +parent 9c20ba82367dab0fe4789e2be400a7fb0c447c34\n> +parent 8cbad082a020b7d4ef729b14e1a654c4f60791c6\n> +author Michael J Gruber 1412951117 +0200\n> +committer Michael J Gruber 1412951117 +0200\n> +mergetag object 8cbad082a020b7d4ef729b14e1a654c4f60791c6\n> + type commit\n> + tag stag\n> + tagger Michael J Gruber 1351067460 +0200\n> + \n> + tagmess\n> + -----BEGIN PGP SIGNATURE-----\n> + Version: GnuPG v1.4.12 (GNU/Linux)\n> + \n> + iQIcBAABCgAGBQJQh6dPAAoJELR76rQkz552ZBEP/3vkpftZnhsUkGhqXXptnRhz\n> + 5A3n+BqFTsh4d4C15lcRcevwTyyQF61vrFKFRE7Cl5XVqVHowW0al+Dx7j5p35Mz\n> + PqBZUbEkBFc9xY8WasQYbJl5yDboc8Ora71SEJ1k59duETXmZ67ISpEe6HF3d2xK\n> + 3BGfqaBMwU+Aql0pDMtysoOgEgs7d/Vin9gIXJcqAvw71bpNyZvFUln3do2eLC/v\n> + VW0bVvAN3B66fLx3li8hEZ4wfrg0Uui5zSN95+uc2DUGW03BNR/sKhYXstHAoqef\n> + 4WIAD70e+9vArh8WqPTIUWl0w+1ixgVvGckHXHW10MdwkoVtwo4tawRxngLBKuI9\n> + pUu7dc/TIVl15z/y1EmQ25rB4WV9M9W+uRauUi/T3c0hfSuZkB6B1tCu3QStPbWz\n> + AK3O6Neoni2NgMDLmrWzgDZA3Z/+h9RBV/kNda0RpbWZYJOJILBR+Q8+BZOwDZX/\n> + hu/tITC7IHVJgMXYGlEFybEn/clbtLsZr8zLlSZyropl0mvUBLeBCrjYBQuDN86g\n> + yew/Tzs9T5MEFagUkbRERz5rP5OIE9XpXcHMsZve7cCL3YQy0LOkZk3RZKUsbv8g\n> + MVU1px5/ImBkr0MU0XZxstsAV0YPiON3+qMOnrdGuFx11YQi6cmIA2eww2KPqzHY\n> + YKirAGNintaD8yXAlwLd\n> + =wF8p\n> + -----END PGP SIGNATURE-----\n> +\n> +Merge tag 'stag' into HEAD\n> +\n> +tagmess\n> +\n> +Conflicts:\n> +\t...\n> +----\n"},{"id":"251015","messageId":"544A71F3.1020607@drmicha.warpmail.net","threadId":"37782","inReplyTo":"xmqq7fzshqrb.fsf@gitster.dls.corp.google.com","subject":"Re: [PATCH 1/2] Documentation/technical: signature formats","fromName":"Michael J Gruber","fromEmail":"git@drmicha.warpmail.net","sentAt":"2014-10-24T15:36:19Z","receivedAt":"2014-10-24T15:36:19Z","isPatch":true,"sender":{"key":"git@grubix.eu","avatar":"https://avatars.githubusercontent.com/u/233215?v=4"},"body":"Junio C Hamano schrieb am 22.10.2014 um 21:02:\n> Michael J Gruber writes:\n> \n>> Various formats for storing signatures have accumulated by now.\n>> Document them to keep track (and maybe avoid yet another one).\n> \n> I haven't looked at the description closely, but it is a good thing\n> to describe signature in a tag and in a commit in detail, which we\n> failed to do so far.\n> \n> The principle is essentially the same between the signature on a tag\n> and on a commit: a detached PGP signature over the remainder of the\n> object data is created, and then the signature is inserted into an\n> appropriate place in the resulting object. That \"appropriate place\"\n> is influenced by the type and nature of the object.\n\nYes, the detached signature can't easily be appended to a commit object\nthe way it follows a tag object. Conversely, signed tag could easily\nlook like signed commits do (sig in header), but that would require a\nmigration procedure.\n\n> A mergetag is not fundamentally a \"signature\" in the above sense,\n> though. It is just a dump of the object content in a regular object\n> header field (hence indented by one SP), and its contents having PGP\n> SIGNATURE is merely a natural consequence of the object recorded\n> being a signed tag. So the description of it in the same place as\n> description for signed tags and signed commits feels a little bit\n> out of place, but I do not think of a better place to describe it.\n\nI guess referencing the tag object (like other objects do) rather than\nembedding it would have had its merits, but that is beating up a dead\nhorse. On the other hand, we could migrate to \"mergetag sha1\" rather\nthan \"mergetag object foo\" which is easily distinguished, but only\nembedded objects are \"safe\" against non-aware gits.\n\n> Thanks.\n\nThanks, Jakub and Junio.\n\nI will correct the wording for the multiline header and put the mergetag\nlast to make it clearer that it's related but different.\n\nMichael\n"},{"id":"251020","messageId":"xmqqbnp1gzqp.fsf@gitster.dls.corp.google.com","threadId":"37782","inReplyTo":"544A71F3.1020607@drmicha.warpmail.net","subject":"Re: [PATCH 1/2] Documentation/technical: signature formats","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2014-10-24T17:10:38Z","receivedAt":"2014-10-24T17:10:38Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Michael J Gruber writes:\n\n> Junio C Hamano schrieb am 22.10.2014 um 21:02:\n>> Michael J Gruber writes:\n>> \n>>> Various formats for storing signatures have accumulated by now.\n>>> Document them to keep track (and maybe avoid yet another one).\n>> \n>> I haven't looked at the description closely, but it is a good thing\n>> to describe signature in a tag and in a commit in detail, which we\n>> failed to do so far.\n>> \n>> The principle is essentially the same between the signature on a tag\n>> and on a commit: a detached PGP signature over the remainder of the\n>> object data is created, and then the signature is inserted into an\n>> appropriate place in the resulting object. That \"appropriate place\"\n>> is influenced by the type and nature of the object.\n>\n> Yes, the detached signature can't easily be appended to a commit object\n> the way it follows a tag object. Conversely, signed tag could easily\n> look like signed commits do (sig in header), but that would require a\n> migration procedure.\n\nI do not see much point in doing such \"migration\", though. Whom\nis it supposed to help?\n\n>> A mergetag is not fundamentally a \"signature\" in the above sense,\n>> though. It is just a dump of the object content in a regular object\n>> header field (hence indented by one SP), and its contents having PGP\n>> SIGNATURE is merely a natural consequence of the object recorded\n>> being a signed tag. So the description of it in the same place as\n>> description for signed tags and signed commits feels a little bit\n>> out of place, but I do not think of a better place to describe it.\n>\n> I guess referencing the tag object (like other objects do) rather than\n> embedding it would have had its merits, but that is beating up a dead\n> horse.\n\nSuch a format would have defeated a major point of mergetag. The\nheader embeds the data, not a reference to an external object, so\nthat the resulting merge commit can be validated without having an\nextra tag. The resulting repository does not have to keep a tag\nreference that nobody else is interested in, which is an added\nbonus.\n\nI however agree that if there were no downside having to reference\nand maintain an extra tag, having the data there (i.e. the real\n\"mergetag\" format) and a reference there (i.e. your alternative)\nwould have the same level of security and assurance.\n\nThat tells us that whatever is on \"mergetag\" is \"not fundamentally a\nsignature\", as I said already, doesn't it, though?\n\nThe description of \"mergetag\" in this document should not have to\nchange, even when the mechanism used to sign underlying \"tag\"\nobjects were to change in the future. For that, you can just say\nthat it is just a bit-for-bit copy of the tag object that was pulled\ninto the history with the merge. The way how bits from the tag\nobject are recorded there needs to be described. What the bits\nmean (e.g. it has a detached GPG signature over what appeneded in\nwhat way) does not need to be (and I think should not be) repeated\nin the description of \"mergetag\".\n"},{"id":"251046","messageId":"544B5FA1.2050804@gmail.com","threadId":"37782","inReplyTo":"xmqq7fzshqrb.fsf@gitster.dls.corp.google.com","subject":"Re: [PATCH 1/2] Documentation/technical: signature formats","fromName":"Jakub Narębski","fromEmail":"jnareb@gmail.com","sentAt":"2014-10-25T08:30:25Z","receivedAt":"2014-10-25T08:30:25Z","isPatch":true,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"W dniu 2014-10-22 21:02, Junio C Hamano pisze:\n\n> A mergetag is not fundamentally a \"signature\" in the above sense,\n> though. It is just a dump of the object content in a regular object\n> header field (hence indented by one SP), and its contents having PGP\n> SIGNATURE is merely a natural consequence of the object recorded\n> being a signed tag. So the description of it in the same place as\n> description for signed tags and signed commits feels a little bit\n> out of place, but I do not think of a better place to describe it.\n\nDoes this mean that you can merge annotated (but not signed) tag,\nand have it (as description of merged branch) in 'mergetag' header?\n\n-- \nJakub Narębski\n"},{"id":"251212","messageId":"545210A6.5020302@drmicha.warpmail.net","threadId":"37782","inReplyTo":"544B5FA1.2050804@gmail.com","subject":"Re: [PATCH 1/2] Documentation/technical: signature formats","fromName":"Michael J Gruber","fromEmail":"git@drmicha.warpmail.net","sentAt":"2014-10-30T10:19:18Z","receivedAt":"2014-10-30T10:19:18Z","isPatch":true,"sender":{"key":"git@grubix.eu","avatar":"https://avatars.githubusercontent.com/u/233215?v=4"},"body":"Jakub Narębski schrieb am 25.10.2014 um 10:30:\n> W dniu 2014-10-22 21:02, Junio C Hamano pisze:\n> \n>> A mergetag is not fundamentally a \"signature\" in the above sense,\n>> though. It is just a dump of the object content in a regular object\n>> header field (hence indented by one SP), and its contents having PGP\n>> SIGNATURE is merely a natural consequence of the object recorded\n>> being a signed tag. So the description of it in the same place as\n>> description for signed tags and signed commits feels a little bit\n>> out of place, but I do not think of a better place to describe it.\n> \n> Does this mean that you can merge annotated (but not signed) tag,\n> and have it (as description of merged branch) in 'mergetag' header?\n\nWe don't do that (so far).\n\nIn principle we could do that, of course. (But I really wish mergetag\nwould point to the tag object rather than embed it.)\n\nBut the point of the merge tag is to \"bake into the commit object\" some\nverifiable information about the source of the merge, or rather about\nsome of its parents.\n\nJust adding some non-verifiable, \"come-and-go\" information seems to be\nmore suited for notes.\n\nMichael\n"}]}