Re: [PATCH 1/2] Documentation/technical: signature formats

From: Michael J Gruber <git@drmicha.warpmail.net>
Date: Oct 24, 2014, 15:36 UTC
Message-ID: <544A71F3.1020607@drmicha.warpmail.net>
In-Reply-To: <xmqq7fzshqrb.fsf@gitster.dls.corp.google.com>

Junio C Hamano schrieb am 22.10.2014 um 21:02:

Show 14 quoted lines

> Michael J Gruber <git@drmicha.warpmail.net> writes:
> 
>> Various formats for storing signatures have accumulated by now.
>> Document them to keep track (and maybe avoid yet another one).
> 
> I haven't looked at the description closely, but it is a good thing
> to describe signature in a tag and in a commit in detail, which we
> failed to do so far.
> 
> The principle is essentially the same between the signature on a tag
> and on a commit: a detached PGP signature over the remainder of the
> object data is created, and then the signature is inserted into an
> appropriate place in the resulting object.  That "appropriate place"
> is influenced by the type and nature of the object.

Yes, the detached signature can't easily be appended to a commit object the way it follows a tag object. Conversely, signed tag could easily look like signed commits do (sig in header), but that would require a migration procedure.

Show 7 quoted lines

> A mergetag is not fundamentally a "signature" in the above sense,
> though.  It is just a dump of the object content in a regular object
> header field (hence indented by one SP), and its contents having PGP
> SIGNATURE is merely a natural consequence of the object recorded
> being a signed tag.  So the description of it in the same place as
> description for signed tags and signed commits feels a little bit
> out of place, but I do not think of a better place to describe it.

I guess referencing the tag object (like other objects do) rather than embedding it would have had its merits, but that is beating up a dead horse. On the other hand, we could migrate to "mergetag sha1" rather than "mergetag object foo" which is easily distinguished, but only embedded objects are "safe" against non-aware gits.

> Thanks.

Thanks, Jakub and Junio.

I will correct the wording for the multiline header and put the mergetag last to make it clearer that it's related but different.

Michael