Re: [RFC/PATCH] verify-tag: check sig of all tags to given object

From: Junio C Hamano <gitster@pobox.com>
Date: Feb 4, 2012, 06:20 UTC
Message-ID: <7vhaz7jf1d.fsf@alter.siamese.dyndns.org>
In-Reply-To: <20120204055656.GC2477@tgrennan-laptop>

Tom Grennan <tmgrennan@gmail.com> writes:

Show 28 quoted lines

> On Fri, Feb 03, 2012 at 09:22:44PM -0800, Junio C Hamano wrote:
>>Tom Grennan <tmgrennan@gmail.com> writes:
>>
>>> Wouldn't you want Shawn and Jeff to tag the object (commit, tree, or
>>> blob) that you had tagged?
>>
>>No.
>>
>>We _designed_ our tag objects so that they are capable of pointing at
>>another tag, not the object that is pointed at that other tag.  And that
>>is the example usage I gave you.
>>
>>The statement by Shawn and Jeff, "This tag is Gitster's" is exactly that.
>>It was not about asserting the authenticity of the commit. It was about
>>the tag object I created.
>
> Hmm, how about "git verify-tag [[-v] [--to]] <tag|object>"?
> With "--to", all tags to the given tag (or object) are verified.
> Without "--to" just the given <tag> is verified.
>
>>>    gitster$ git verify-tag --pointed v1.7.10
>>>    tag v1.7.10: OK
>>
>>Just saying "$name: OK" will *never* be acceptable. "A signature made by
>>any key in my keychain is fine" is not the usual use case. At least the
>>output needs to be "Good signature from X".
>
> OK, I'll have to play with the gpg --verify-options.

If it wasn't clear enough from my other message, I would rather not to see any change to --verify codepath as the first step. Don't you think that the simplest and cleanest first step is to add --points-at to the list mode, so that with help from "| xargs git tag -v" you can bulk-verify without any other change?