Re: [RFC/PATCH] verify-tag: add --check-name flag

From: Junio C Hamano <gitster@pobox.com>
Date: Jun 7, 2016, 21:05 UTC
Message-ID: <xmqq7fe0pv5b.fsf@gitster.mtv.corp.google.com>
In-Reply-To: <20160607195608.16643-1-santiago@nyu.edu>

santiago@nyu.edu writes:

> 1.- Using a tag ref as a check-out mechanism is pretty common by package
>     managers and other tools. Verifying the tag signature provides
>     authentication guarantees, but there is no feedback that the
>     signature being verified belongs to the intended tag.

Very true.

The above means that the existing package managers and other tools need to be updated with some new code that lets them learn how to tell if the tagname (in their refs/tags/ namespace) matches the intended "real" tag name, and your --check-name option could be that.

But if you are adding new code to the existing package managers and other tools _anyway_, wouldn't it be a more direct solution to let them learn how to tell what the intended "real" tag name is with that new code?

It is true that "git cat-file tag v1.4.11" lets you examine all lines of a given tag object, but the calling program needs to pick pieces apart with something like:

	git cat-file tag v1.4.11 | sed -e '/^$/q' -e 's/^tag //p'

which may be cumbersome. Perhaps, just like "git tag -v v1.4.11" is a way to see if the contents of the tag is signed properly, if you add "git tag --show-tagname v1.4.11" that does the above pipeline, these package managers and other tools can be updated to

	tag="$1"
-	if ! git tag -v "$tag"
+	if ! git tag -v "$tag" ||
+	   test "$tag" != "$(git tag --show-tagname $tag)"
        then
		echo >&2 "Bad tag."
                exit 1
	fi
	make dest=/usr/local/$package/$tag install

Or it could even do this:

	tag="$1"
	if ! git tag -v "$tag"
	if ! git tag -v "$tag"
        then
		echo >&2 "Bad tag."
                exit 1
	fi
+	tag=$(git tag --show-tagname $tag)
	make dest=/usr/local/$package/$tag install

i.e. ignore the refname entirely and use the "real" tagname it reads after validating the signature as the name of the resulting version getting installed, distributed and/or used.