From: Junio C Hamano Date: Fri, 19 Sep 2025 22:34:02 GMT Subject: Re: [PATCH 3/9] docs: reflect actual double signature for tags Message-ID: In-Reply-To: <20250919010911.649831-4-sandals@crustytoothpaste.net> "brian m. carlson" writes: > Signed Tags > ~~~~~~~~~~~ > +We add new fields "gpgsig" and "gpgsig-sha256" to the tag object format to > +allow signing tags in both formats. The in-body signature is used for the > +signature in the current hash algorithm and the header is used for the > +signature in the other algorithm. Thus, a dual-signature tag will contain both Not suggesting a change in the text, but to make sure I am reading the new text correctly. Does "the other algorithm" refer to the compatibility hash algorithm specified by the compatObjectFormat extension and the "current" algorithm refers to the objectFormat extension? > +an in-body signature and a gpgsig-sha256 header for the SHA-1 format of an > +object or both an in-body signature and a gpgsig header for the SHA-256 format > +of and object. > > -This means tags can be signed > +The signed payload of the tag is the content of the tag in the current > +algorithm with both its gpgsig and gpgsig-sha256 fields and My reading of the previous paragraph is that we cannot have gpgsig and gpgsig-sha256 fields on a single object at the same time. Should we say "gpgsig or gpgsig-sha256" (instead of "and"), to get the resulting text parsable as: both its gpgsig or gpgsig-sha256 fields and "-----BEGIN PGP SIGNATURE-----" delimited in-body signature removed. instead? > +"-----BEGIN PGP SIGNATURE-----" delimited in-body signature removed. > > -1. using SHA-1 only, as in existing signed tag objects > -2. using both SHA-1 and SHA-256, by using gpgsig-sha256 and an in-body > - signature. > -3. using only SHA-256, by only using the gpgsig-sha256 field. > +This means tags can be signed using one or both algorithms. > > Mergetag embedding > ~~~~~~~~~~~~~~~~~~