Re: git tag -v should verify that the tag signer intended the same tag name as the user is verifying

From: Jeff King <peff@peff.net>
Date: Mar 26, 2019, 18:40 UTC
Message-ID: <20190326184001.GD24105@sigill.intra.peff.net>
In-Reply-To: <87ftr9h72a.fsf@fifthhorseman.net>

On Tue, Mar 26, 2019 at 06:35:57PM +0100, Daniel Kahn Gillmor wrote:

> But I don't see how to use --format with "git tag -v" at all.  Can you
> show me what i'm doing wrong?  git-tag(1) says that --format defaults to
> '%(refname:strip=2)', but git tag -v behaves differently when i specify
> that same default explicitly:

Hmm.

I think the documentation is unclear. For a normal listing of tags, the default format is the stripped refname, and you can override it with --format.

For "-v", the default is to dump the whole tag contents (i.e., traditionally it just ran "verify-tag -v" under the hood, though I think it is all done internally now).

So this doesn't surprise me:

Show 13 quoted lines

>     0 dkg@alice:~/src/pkg-gnupg/gnupg2$ git tag -v gnupg-2.2.13
>     object 7922e2dd1c7eee48a8a2cf4799827942489ddd0f
>     type commit
>     tag gnupg-2.2.13
>     tagger Werner Koch <wk@gnupg.org> 1549985965 +0100
> 
>     You may want to watch the Ellsberg/Chomsky discussion
>     at <https://riseuptimes.org/2018/04/25/daniel-ellsberg-and-noam-chomsky-discuss-nuclear-war/>
>     or at <https://theintercept.com/chomsky-ellsberg/>
>     gpg: Signature made Tue 12 Feb 2019 04:41:32 PM CET
>     gpg:                using RSA key D8692123C4065DEA5E0F3AB5249B39D24F25E3B6
>     gpg: Good signature from "Werner Koch (dist sig)" [full]
>     Primary key fingerprint: D869 2123 C406 5DEA 5E0F  3AB5 249B 39D2 4F25 E3B6

But this does:

>     0 dkg@alice:~/src/pkg-gnupg/gnupg2$ git tag -v --format='%(refname:strip=2)' gnupg-2.2.13

I'd expect it to print the tagname here. It looks like we only feed the partial tagname to the ref-formatting machinery, so the "strip" doesn't do what you'd expect.

It also doesn't show the gpg output, though it does actually verify the tag. But AFAIK there's no format specifier in the ref-filter language for showing the GPG output! What a mess.

-Peff