git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH v2 0/5] Support for commits signed by multiple algorithms

From
Junio C Hamano <gitster@pobox.com>
Date
Jan 11, 2021, 22:16 UTC
Message-ID
<xmqq5z436rwe.fsf@gitster.c.googlers.com>
In-Reply-To
<20210111035840.2437737-1-sandals@crustytoothpaste.net>
"brian m. carlson" <sandals@crustytoothpaste.net> writes:
Show 13 quoted lines
> This series introduces support for verifying commits and tags signed by
> multiple algorithms.
>
> Originally, we had planned for SHA-256 tags to stuff the signature in a
> header instead of using a trailing signature, and a patch to do that was
> sent out in part 1/3.  Unfortunately, for whatever reason, that patch
> didn't make it into the master branch, and so we use trailing signatures
> there.
>
> We can't change this now, because otherwise it would be ambiguous
> whether the trailing signature on a SHA-256 object was for the SHA-256
> contents or whether the contents were a rewritten SHA-1 object with no
> SHA-256 signature at all.

How widely are SHA-256 tags in use in the real world, though? Is it really too late to fix that already?

Previous: SZEDER GáborNext: brian m. carlson
Message 21 of 39 in “Support for commits signed by multiple algorithms”
  1. 0/5 Support for commits signed by multiple algorithmsbrian m. carlson, Jan 11, 2021
  2. 1/5 commit: ignore additional signatures when parsing signed commitsbrian m. carlson, Jan 11, 2021
  3. 3/5 commit: allow parsing arbitrary buffers with headersbrian m. carlson, Jan 11, 2021
  4. 2/5 gpg-interface: improve interface for parsing tagsbrian m. carlson, Jan 11, 2021
  5. Junio C HamanoJan 12, 2021
  6. brian m. carlsonJan 14, 2021
  7. Junio C HamanoJan 15, 2021
  8. 4/5 ref-filter: hoist signature parsingbrian m. carlson, Jan 11, 2021
  9. 5/6 fixup! commit: ignore additional signatures when parsing signed commitsbrian m. carlson, Jan 11, 2021
  10. brian m. carlsonJan 11, 2021
  11. 5/5 gpg-interface: remove other signature headers before verifyingbrian m. carlson, Jan 11, 2021
  12. 6/6 gpg-interface: remove other signature headers before verifyingbrian m. carlson, Jan 11, 2021
  13. 0/5 Support for commits signed by multiple algorithmsbrian m. carlson, Jan 11, 2021
  14. 3/5 commit: allow parsing arbitrary buffers with headersbrian m. carlson, Jan 11, 2021
  15. 4/5 ref-filter: hoist signature parsingbrian m. carlson, Jan 11, 2021
  16. 2/5 gpg-interface: improve interface for parsing tagsbrian m. carlson, Jan 11, 2021
  17. Junio C HamanoJan 12, 2021
  18. 5/5 gpg-interface: remove other signature headers before verifyingbrian m. carlson, Jan 11, 2021
  19. 1/5 commit: ignore additional signatures when parsing signed commitsbrian m. carlson, Jan 11, 2021
  20. SZEDER GáborJan 12, 2021
  21. Junio C HamanoJan 11, 2021
  22. brian m. carlsonJan 11, 2021
  23. Junio C HamanoJan 12, 2021
  24. brian m. carlsonJan 12, 2021
  25. 0/6 Support for commits signed by multiple algorithmsbrian m. carlson, Jan 18, 2021
  26. 1/6 ref-filter: switch some uses of unsigned long to size_tbrian m. carlson, Jan 18, 2021
  27. 2/6 commit: ignore additional signatures when parsing signed commitsbrian m. carlson, Jan 18, 2021
  28. 4/6 commit: allow parsing arbitrary buffers with headersbrian m. carlson, Jan 18, 2021
  29. 3/6 gpg-interface: improve interface for parsing tagsbrian m. carlson, Jan 18, 2021
  30. 6/6 gpg-interface: remove other signature headers before verifyingbrian m. carlson, Jan 18, 2021
  31. 5/6 ref-filter: hoist signature parsingbrian m. carlson, Jan 18, 2021
  32. 0/6 Support for commits signed by multiple algorithmsbrian m. carlson, Feb 11, 2021
  33. 4/6 commit: allow parsing arbitrary buffers with headersbrian m. carlson, Feb 11, 2021
  34. 1/6 ref-filter: switch some uses of unsigned long to size_tbrian m. carlson, Feb 11, 2021
  35. 2/6 commit: ignore additional signatures when parsing signed commitsbrian m. carlson, Feb 11, 2021
  36. 3/6 gpg-interface: improve interface for parsing tagsbrian m. carlson, Feb 11, 2021
  37. 5/6 ref-filter: hoist signature parsingbrian m. carlson, Feb 11, 2021
  38. 6/6 gpg-interface: remove other signature headers before verifyingbrian m. carlson, Feb 11, 2021
  39. Junio C HamanoFeb 11, 2021

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.