{"thread":{"id":"63946","subject":"Signing commits and tags differently","startedAt":"2025-08-12T15:25:13Z","lastAt":"2025-08-12T21:16:13Z","messageCount":2,"participants":["Andrea Pappacoda","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"524056","messageId":"DC0JSOC14W8U.3UCX8TG6X7W5O@debian.org","threadId":"63946","inReplyTo":null,"subject":"Signing commits and tags differently","fromName":"Andrea Pappacoda","fromEmail":"tachi@debian.org","sentAt":"2025-08-12T15:18:19Z","receivedAt":"2025-08-12T15:25:13Z","isPatch":false,"sender":{"key":"tachi@debian.org","avatar":null},"body":"Hi all!\n\nI would like to configure Git to automatically sign commits using SSH \nkeys, while using OpenPGP when creating signed tags. As far as I can \ntell, this isn't currently possible.\n\nWhat I was thinking about were a couple of options like \ncommit.gpg.format and tag.gpg.format, as we already have commit.gpgSign \nand tag.gpgSign. Of course, differently namespaced options like \ngpg.tag.format would work too.\n\nWhat do you think? Does this make any sense to you? Let me know!\n\nBye :)\n\nP.S. please keep me CC'd; I'm not subscribed\n"},{"id":"524092","messageId":"aJuvGtiZ8ll_SeIv@fruit.crustytoothpaste.net","threadId":"63946","inReplyTo":"DC0JSOC14W8U.3UCX8TG6X7W5O@debian.org","subject":"Re: Signing commits and tags differently","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2025-08-12T21:16:10Z","receivedAt":"2025-08-12T21:16:13Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2025-08-12 at 15:18:19, Andrea Pappacoda wrote:\n> Hi all!\n\nHi,\n\n> I would like to configure Git to automatically sign commits using SSH keys,\n> while using OpenPGP when creating signed tags. As far as I can tell, this\n> isn't currently possible.\n\nI agree this isn't possible with the default commands, although you\ncould solve with with an alias (such as `alias.signed-tag=\"!f() { git -c\ngpg.format=openpgp tag \"$@\"; };f\"`).\n\nI'm interested to hear more about your use case for this split, since\nit's the first time I've heard about someone wanting to do this.\n\n> What I was thinking about were a couple of options like commit.gpg.format\n> and tag.gpg.format, as we already have commit.gpgSign and tag.gpgSign. Of\n> course, differently namespaced options like gpg.tag.format would work too.\n> \n> What do you think? Does this make any sense to you? Let me know!\n\nI don't have a strong opinion about adding this feature or not\n(especially since I don't know about your use case), but I think if this\nfeature were implemented we'd need to have the format options default to\nthe current config option to not regress functionality for existing\nusers.\n\nThere's also the issue that this makes verification more difficult.\nAfter all, you sign the data once, but presumably the data is verified\nmany times by many different users (or software acting on their behalf,\nsuch as a forge).  That means that we'd either need to autodetect the\nsignature and invoke the right tool (which we may already do) or every\nindividual user would need to have the appropriate configuration set up\nfor both.\n\nAgain, no strong opinions here, just thoughts about what an\nimplementation might look like.\n-- \nbrian m. carlson (they/them)\nToronto, Ontario, CA\n"}]}