Re: [PATCH 3/9] docs: reflect actual double signature for tags

From: Junio C Hamano <gitster@pobox.com>
Date: Sep 20, 2025, 17:04 UTC
Message-ID: <xmqqms6pxdg4.fsf@gitster.g>
In-Reply-To: <aM7IQibwwKFJZcYE@fruit.crustytoothpaste.net>

"brian m. carlson" <sandals@crustytoothpaste.net> writes:

Show 23 quoted lines

> On 2025-09-19 at 22:34:02, Junio C Hamano wrote:
>> "brian m. carlson" <sandals@crustytoothpaste.net> writes:
>> 
>> >  Signed Tags
>> >  ~~~~~~~~~~~
>> > +We add new fields "gpgsig" and "gpgsig-sha256" to the tag object format to
>> > +allow signing tags in both formats.  The in-body signature is used for the
>> > +signature in the current hash algorithm and the header is used for the
>> > +signature in the other algorithm.  Thus, a dual-signature tag will contain both
>> 
>> Not suggesting a change in the text, but to make sure I am reading
>> the new text correctly.  Does "the other algorithm" refer to the
>> compatibility hash algorithm specified by the compatObjectFormat
>> extension and the "current" algorithm refers to the objectFormat
>> extension?
>
> The "current algorithm" is usually the main algorithm (that is, SHA-256
> where `extensions.objectformat` is `sha256`) and the "other algorithm"
> is the compatibility algorithm (SHA-1 in that case).  However, when you
> convert that object to SHA-1 to hash it in SHA-1, the "current
> algorithm" becomes SHA-1 and the "other algorithm" is SHA-256.
>
> Does that make sense?

Let me see if I got it right by trying to paraphrase the above.

For any object that is suitable to be stored in a repository with objectFormat and compatObjectFormat set, "current" is the former, and "the other" is the latter.

Your goal is not educating me, though. I wanted to make sure that the text would be understood by the target audience of this document in a way you intended it to be.

Thanks.