From: Tom Grennan <tmgrennan@gmail.com>
Date: Sat, 04 Feb 2012 06:49:42 GMT
Subject: Re: [RFC/PATCH] verify-tag: check sig of all tags to given object
Message-ID: <20120204064942.GD2477@tgrennan-laptop>
In-Reply-To: <7vhaz7jf1d.fsf@alter.siamese.dyndns.org>

On Fri, Feb 03, 2012 at 10:20:14PM -0800, Junio C Hamano wrote:
>Tom Grennan <tmgrennan@gmail.com> writes:
>
>> On Fri, Feb 03, 2012 at 09:22:44PM -0800, Junio C Hamano wrote:
>>>Tom Grennan <tmgrennan@gmail.com> writes:
>>>
>>>> Wouldn't you want Shawn and Jeff to tag the object (commit, tree, or
>>>> blob) that you had tagged?
>>>
>>>No.
>>>
>>>We _designed_ our tag objects so that they are capable of pointing at
>>>another tag, not the object that is pointed at that other tag.  And that
>>>is the example usage I gave you.
>>>
>>>The statement by Shawn and Jeff, "This tag is Gitster's" is exactly that.
>>>It was not about asserting the authenticity of the commit. It was about
>>>the tag object I created.
>>
>> Hmm, how about "git verify-tag [[-v] [--to]] <tag|object>"?
>> With "--to", all tags to the given tag (or object) are verified.
>> Without "--to" just the given <tag> is verified.
>>
>>>>    gitster$ git verify-tag --pointed v1.7.10
>>>>    tag v1.7.10: OK
>>>
>>>Just saying "$name: OK" will *never* be acceptable. "A signature made by
>>>any key in my keychain is fine" is not the usual use case. At least the
>>>output needs to be "Good signature from X".
>>
>> OK, I'll have to play with the gpg --verify-options.
>
>If it wasn't clear enough from my other message, I would rather not to see
>any change to --verify codepath as the first step.  Don't you think that
>the simplest and cleanest first step is to add --points-at to the list
>mode, so that with help from "| xargs git tag -v" you can bulk-verify
>without any other change?

No, I missed that. So you're suggesting,
git tag [-n[<num>]] -l [--contains <commit>] [--points-at <object>] [<pattern>...]

If so, I'll look into it tomorrow.

thanks,
TomG