git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Git-commits mailing list feed.

From
PJPaul Jakma <paul@clubi.ie>
Date
Apr 25, 2005, 03:40 UTC
Message-ID
<Pine.LNX.4.62.0504250435050.14200@sheen.jakma.org>
In-Reply-To
<Pine.LNX.4.62.0504250413200.14200@sheen.jakma.org>
On Mon, 25 Apr 2005, Paul Jakma wrote:
Show 14 quoted lines
> You dont even need it, see my other mail. If:
>
> - the signature is an object and added after the commit object
>
> - tools know that signatures are 'proxies of' or precursors to the
>  objects they are signing (which makes sense, a signature by
>  definition refers to something else)
>
> - the signature object refers to the object it is signing (eg a
>  'Signing <object ID>' header)
>
> Then head can simply be the signature object and tools can find the 
> commit by following the 'Signing' field of the signature (they dont 
> even need to check the signature is valid). No index lookup needed.
> You only need the index for historical verification really, and you can 
> always generate an index if needs be. (and have the tools maintain it).

Uh, I have no idea whether verifying a signature of a commit object is sufficient, ie equivalent to signing each file.

commit refers to tree objects, which I presume lists the SHA-1 object IDs of files, but IIRC Linus already described why a signature of the commit object should not be used to trust the rest of commit.. (i'll have to find his mail). If so, an index is required.

regards,
-- 
Paul Jakma	paul@clubi.ie	paul@jakma.org	Key ID: 64A2FF6A
Fortune:
Old programmers never die, they just hit account block limit.
Previous: Paul JakmaNext: Paul Jakma
Message 34 of 55 in “Re: Git-commits mailing list feed.”
  1. David WoodhouseApr 21, 2005
  2. Linus TorvaldsApr 23, 2005
  3. Linus TorvaldsApr 23, 2005
  4. Fabian FranzApr 23, 2005
  5. Andreas GalApr 23, 2005
  6. SeanApr 23, 2005
  7. Thomas GlanzmannApr 23, 2005
  8. SeanApr 23, 2005
  9. Linus TorvaldsApr 23, 2005
  10. Thomas GlanzmannApr 23, 2005
  11. Linus TorvaldsApr 23, 2005
  12. SeanApr 23, 2005
  13. Linus TorvaldsApr 23, 2005
  14. SeanApr 23, 2005
  15. Linus TorvaldsApr 23, 2005
  16. Junio C HamanoApr 23, 2005
  17. Linus TorvaldsApr 23, 2005
  18. Junio C HamanoApr 23, 2005
  19. Paul JakmaApr 24, 2005
  20. Paul JakmaApr 24, 2005
  21. David A. WheelerApr 25, 2005
  22. Paul JakmaApr 25, 2005
  23. David A. WheelerApr 25, 2005
  24. Paul JakmaApr 25, 2005
  25. Paul JakmaApr 25, 2005
  26. Linus TorvaldsApr 25, 2005
  27. Fabian FranzApr 25, 2005
  28. Andreas GalApr 25, 2005
  29. Linus TorvaldsApr 25, 2005
  30. David A. WheelerApr 25, 2005
  31. David GreavesApr 25, 2005
  32. David A. WheelerApr 25, 2005
  33. Paul JakmaApr 25, 2005
  34. Paul JakmaApr 25, 2005
  35. Paul JakmaApr 25, 2005
  36. New option (-H) for rpush/rpull to update HEADAndreas Gal, Apr 25, 2005
  37. Daniel BarkalowApr 25, 2005
  38. Andreas GalApr 25, 2005
  39. Daniel BarkalowApr 25, 2005
  40. Matt DomschApr 25, 2005
  41. Jan HarkesApr 25, 2005
  42. Thomas GlanzmannApr 23, 2005
  43. Thomas GlanzmannApr 23, 2005
  44. Jan HarkesApr 23, 2005
  45. Linus TorvaldsApr 23, 2005
  46. Junio C HamanoApr 23, 2005
  47. Jan HarkesApr 23, 2005
  48. Linus TorvaldsApr 23, 2005
  49. Jan HarkesApr 23, 2005
  50. Git transfer protocols (was: Re: Git-commits mailing list feed)Mike Taht, Apr 23, 2005
  51. Jan HarkesApr 23, 2005
  52. Linus TorvaldsApr 23, 2005
  53. Suggestion: generalize signed tags into "assertion objects"David A. Wheeler, Apr 23, 2005
  54. Jeff GarzikApr 23, 2005
  55. David WoodhouseApr 25, 2005

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.