Re: Tags

From: H. Peter Anvin <hpa@zytor.com>
Date: Jul 1, 2005, 22:44 UTC
Message-ID: <42C5C75F.4040100@zytor.com>
In-Reply-To: <m1u0jef8z9.fsf@ebiederm.dsl.xmission.com>

Eric W. Biederman wrote:

Show 11 quoted lines

> 
> There is a question of how bad is this.   For releases you certainly
> need some kind of signature that people can verify and we
> already have that but I think we can keep spoofing tags
> down to the same level as spoofing patches.
> 
> Basically all this takes is to make your global namespace
> the committer email address and you have the rule that
> you can only tag your own commits.  Then when you merge
> tags you never automatically add tags to your own tag namespace.
>

Doesn't work. You can trivially generate a key with someone else's address. It would require a full PKI.

	-hpa

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.