Re: [PATCH v2] Add the tag.gpgsign option to sign all created tags

Laurent Arnoud <laurent@spkdev.net> writes:

I presume that you meant "all annotated tags" here. But I am not sure it this is sensible.

That sound quite counter-intuitive.

    $ git tag -s -m "my message" v1.0

is an explicit request to create a signed tag, as opposed to

    $ git tag -a -m "my message" v1.0

is an explicit request to create an unsigned annotated tag.  So 

I think a short-hand

    $ git tag -m "my message" v1.0

falls back to annotated and not signed tag, and I can understand if the patch is about allowing the user to tweak this fallback to create signed tag instead.

So I do not see why you need a new --no-sign option at all. If you have the configuration and you do want to create an unsigned annotated tag one-shot, all you need is to explicitly ask for "-a" i.e.

    $ git tag -a -m "my message" v1.0

isn't it?

If you are forcing users to always leave a message and then further forcing users to always sign with the single new configuration, i.e.

    $ git tag v1.0
    ... opens the editor to ask for a message ...
    ... then makes the user sign with GPG ...

then I would first have to say that is a bad idea.

I can sort-of understand (but do not necessarily agree that it is a good idea) adding new two configurations, i.e.

 - "even without -a/-s, force the user to annotate the tag" is one
   configuration, and

 - "even when the user did not say -s, force the user to sign an
   annotated tag" is the other.

And with such a system, I can see why you would need an option "--lightweight" to force creation of a light-weight tag (i.e. to countermand the first one). You can view this new option as something that sits next to existing -a/-s. The current system lets user choose among the three variants (lightweight, annotated and signed) by not giving any, giving -a, and giving -s option respectively, but with the "--lightweight" option, the user can ask for one of the three explicitly, as opposed to using "lack of either -a/-s" as a signal to create lightweight one.

And in the context of such a system, "--no-sign" may make sense to override the second configuration (i.e. "force the user to sign an annotated tag").

But otherwise, adding only "--no-sign" does not make much sense to me, as it implies "not signing always means annotated", which is not true. It is unclear between lightweight and annotated which one the user who says "--no-sign" really wants.