Re: [PATCH] request-pull: filter out SSH/X.509 tag signatures
- From
Gwyneth Morgan <gwymor@tilde.club>
- Date
- Jan 25, 2023, 23:45 UTC
- Message-ID
- <Y9G+/e5ghEsO3hIb@tilde.club>
- In-Reply-To
- <xmqq8rhqdwxl.fsf@gitster.g>
On 2023-01-25 15:19:34-0800, Junio C Hamano wrote:
> Please sign-off your contribution. > cf. Documentation/SubmittingPatches[[sign-off]]
Oops! I will resend with a sign-off.
Show 18 quoted lines
> > git-request-pull.sh | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/git-request-pull.sh b/git-request-pull.sh > > index 2d0e44656c..01640a044b 100755 > > --- a/git-request-pull.sh > > +++ b/git-request-pull.sh > > @@ -153,7 +153,7 @@ for you to fetch changes up to %H: > > if test $(git cat-file -t "$head") = tag > > then > > git cat-file tag "$head" | > > - sed -n -e '1,/^$/d' -e '/^-----BEGIN PGP /q' -e p > > + sed -n -e '1,/^$/d' -e '/^-----BEGIN \(PGP\|SSH\|SIGNED\) /q' -e p > > This makes readers debate themselves if being more specific and > narrow like the posted patch is safer and better, or making it > looser by just requiring "^-----BEGIN " and making it forward > looking is sufficient and maintainable.
I could imagine someone having a tag with a line starting that way (not realizing it's a common pattern for signatures to take) and being confused at why it's being removed. The likelihood of someone doing that, and using request-pull with that tag, is pretty low though, so I don't have a strong preference.