Re: Git-commits mailing list feed.

From: Linus Torvalds <torvalds@osdl.org>
Date: Apr 23, 2005, 19:38 UTC
Message-ID: <Pine.LNX.4.58.0504231234550.2344@ppc970.osdl.org>
In-Reply-To: <2911.10.10.10.24.1114279589.squirrel@linux1>

On Sat, 23 Apr 2005, Sean wrote:

> 
> A script that knows how to validate signed tags, can easly strip off all
> the signing overhead for display.   Users of scripts that don't understand
> will see the cruft, but at least it will still be usable.

NO.

Guys, I will say this once more: git will not look at the signature.

That means that we don't "strip them off", because dammit, they DO NOT EXIST as far as git is concerned. This is why a tag-file will _always_ start with

	commit <commit-sha1>
	tag <tag-name>

because that way we can use fsck and validate reachability and have things that want trees (or commits) take tag-files instead, and git will automatically look up the associated tree/commit. And it will do so _without_ having to understand about signing, since signing is for trust between _people_ not for git.

And that is why I from the very beginning tried to make ti very clear that the signature goes at the end. Not at the beginning, not in the middle, and not in a different file. IT GOES AT THE END.

		Linus