Re: git-pull and tag objects

From: Junio C Hamano <junkio@cox.net>
Date: Feb 11, 2007, 21:55 UTC
Message-ID: <7vfy9ccqaa.fsf@assigned-by-dhcp.cox.net>
In-Reply-To: <Pine.LNX.4.64.0702101347350.8424@woody.linux-foundation.org>

Linus Torvalds <torvalds@linux-foundation.org> writes:

Show 9 quoted lines

> On Sat, 10 Feb 2007, Jakub Narebski wrote:
>> 
>> One of the solutions, used in git.git repository, is to put public key
>> as a out-of-tree blob using git-hash-object, then tag it using singed tag
>> with instruction about how to extract key in the tag message (tag comment).
>
> No. That's horrible. Yes, it's what Junio did, but if you don't trust the 
> archive, the _last_ thing you should do is to depend on a blob in the 
> archive itself to contain the thing to make you trust it more.

True. I should have made it clear it was purely a convenient way for people to get the public key and verifying that key needs to be done on a separate channel. Otherwise it would have confused people (exactly like Jakub was confused).