From: Junio C Hamano <gitster@pobox.com>
Date: Thu, 21 Mar 2019 01:31:59 GMT
Subject: Re: git tag -v should verify that the tag signer intended the same tag name as the user is verifying
Message-ID: <xmqq1s31ui5s.fsf@gitster-ct.c.googlers.com>
In-Reply-To: <xmqq5zsduinf.fsf@gitster-ct.c.googlers.com>

Junio C Hamano <gitster@pobox.com> writes:

>  * "git tag -v $(git rev-parse v1.0.0)" should work, but the command

Sorry, forget about this part of my message.  I completely forgot the
discussion we had a few years ago:

https://public-inbox.org/git/CAPc5daV9ZvHqFtdzr565vp6Mv7O66ySr-p5Vi8o6bd6=GyVELg@mail.gmail.com/

In short, "git tag -v TAGNAME" does not take an arbitrary object
name, TAGNAME does not go through the usual ref dwimming rules
(i.e. checking for .git/%s, .git/tag/%s, .git/heads/%s, ... to find
one) but only looks at refs/tags/TAGNAME alone.  So we always have
the refname it came from when inspecting tag contents that tells
what tagname the tag has.

The other point still stands; there are legitimate reasons people
would want to have a tag with v1.0.0 tagname in somewhere that is
not refs/tags/v1.0.0 and an extra validation must need to make sure
it won't error out, even though warning is probably acceptable.