Re: [PATCH 3/9] docs: reflect actual double signature for tags

From: Junio C Hamano <gitster@pobox.com>
Date: Sep 19, 2025, 22:34 UTC
Message-ID: <xmqq348i138l.fsf@gitster.g>
In-Reply-To: <20250919010911.649831-4-sandals@crustytoothpaste.net>

"brian m. carlson" <sandals@crustytoothpaste.net> writes:

Show 6 quoted lines

>  Signed Tags
>  ~~~~~~~~~~~
> +We add new fields "gpgsig" and "gpgsig-sha256" to the tag object format to
> +allow signing tags in both formats.  The in-body signature is used for the
> +signature in the current hash algorithm and the header is used for the
> +signature in the other algorithm.  Thus, a dual-signature tag will contain both

Not suggesting a change in the text, but to make sure I am reading the new text correctly. Does "the other algorithm" refer to the compatibility hash algorithm specified by the compatObjectFormat extension and the "current" algorithm refers to the objectFormat extension?

Show 7 quoted lines

> +an in-body signature and a gpgsig-sha256 header for the SHA-1 format of an
> +object or both an in-body signature and a gpgsig header for the SHA-256 format
> +of and object.
>  
> -This means tags can be signed
> +The signed payload of the tag is the content of the tag in the current
> +algorithm with both its gpgsig and gpgsig-sha256 fields and

My reading of the previous paragraph is that we cannot have gpgsig and gpgsig-sha256 fields on a single object at the same time.

Should we say "gpgsig or gpgsig-sha256" (instead of "and"), to get the resulting text parsable as:

	both 
		its gpgsig or gpgsig-sha256 fields
	and
		"-----BEGIN PGP SIGNATURE-----" delimited in-body signature
	removed.

instead?

Show 10 quoted lines

> +"-----BEGIN PGP SIGNATURE-----" delimited in-body signature removed.
>  
> -1. using SHA-1 only, as in existing signed tag objects
> -2. using both SHA-1 and SHA-256, by using gpgsig-sha256 and an in-body
> -   signature.
> -3. using only SHA-256, by only using the gpgsig-sha256 field.
> +This means tags can be signed using one or both algorithms.
>  
>  Mergetag embedding
>  ~~~~~~~~~~~~~~~~~~