Re: [PATCH] request-pull: filter out SSH/X.509 tag signatures

From: Junio C Hamano <gitster@pobox.com>
Date: Jan 25, 2023, 23:19 UTC
Message-ID: <xmqq8rhqdwxl.fsf@gitster.g>
In-Reply-To: <20230125230117.3915827-1-gwymor@tilde.club>

Gwyneth Morgan <gwymor@tilde.club> writes:

> git request-pull filters PGP signatures out of the tag message, but not
> SSH or X.509 signatures.
> ---

Please sign-off your contribution. cf. Documentation/SubmittingPatches[[sign-off]]

Show 13 quoted lines

>  git-request-pull.sh | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/git-request-pull.sh b/git-request-pull.sh
> index 2d0e44656c..01640a044b 100755
> --- a/git-request-pull.sh
> +++ b/git-request-pull.sh
> @@ -153,7 +153,7 @@ for you to fetch changes up to %H:
>  if test $(git cat-file -t "$head") = tag
>  then
>  	git cat-file tag "$head" |
> -	sed -n -e '1,/^$/d' -e '/^-----BEGIN PGP /q' -e p
> +	sed -n -e '1,/^$/d' -e '/^-----BEGIN \(PGP\|SSH\|SIGNED\) /q' -e p

This makes readers debate themselves if being more specific and narrow like the posted patch is safer and better, or making it looser by just requiring "^-----BEGIN " and making it forward looking is sufficient and maintainable.

If this were signed-off already, I would have said "let's queue it as-is, while waiting for input from others", but without a sign-off I am not queuing (yet).

Thanks.