Re: [PATCH 3/9] docs: reflect actual double signature for tags

> "brian m. carlson" <sandals@crustytoothpaste.net> writes:
> 
> >  Signed Tags
> >  ~~~~~~~~~~~
> > +We add new fields "gpgsig" and "gpgsig-sha256" to the tag object format to
> > +allow signing tags in both formats.  The in-body signature is used for the
> > +signature in the current hash algorithm and the header is used for the
> > +signature in the other algorithm.  Thus, a dual-signature tag will contain both
> 
> Not suggesting a change in the text, but to make sure I am reading
> the new text correctly.  Does "the other algorithm" refer to the
> compatibility hash algorithm specified by the compatObjectFormat
> extension and the "current" algorithm refers to the objectFormat
> extension?

> > +an in-body signature and a gpgsig-sha256 header for the SHA-1 format of an
> > +object or both an in-body signature and a gpgsig header for the SHA-256 format
> > +of and object.
> >  
> > -This means tags can be signed
> > +The signed payload of the tag is the content of the tag in the current
> > +algorithm with both its gpgsig and gpgsig-sha256 fields and
> 
> My reading of the previous paragraph is that we cannot have gpgsig
> and gpgsig-sha256 fields on a single object at the same time.

> Should we say "gpgsig or gpgsig-sha256" (instead of "and"), to get
> the resulting text parsable as:
> 
> 	both 
> 		its gpgsig or gpgsig-sha256 fields
> 	and
> 		"-----BEGIN PGP SIGNATURE-----" delimited in-body signature
> 	removed.
> 
> instead?