From: Junio C Hamano Date: Sat, 20 Sep 2025 17:04:43 GMT Subject: Re: [PATCH 3/9] docs: reflect actual double signature for tags Message-ID: In-Reply-To: "brian m. carlson" writes: > On 2025-09-19 at 22:34:02, Junio C Hamano wrote: >> "brian m. carlson" writes: >> >> > Signed Tags >> > ~~~~~~~~~~~ >> > +We add new fields "gpgsig" and "gpgsig-sha256" to the tag object format to >> > +allow signing tags in both formats. The in-body signature is used for the >> > +signature in the current hash algorithm and the header is used for the >> > +signature in the other algorithm. Thus, a dual-signature tag will contain both >> >> Not suggesting a change in the text, but to make sure I am reading >> the new text correctly. Does "the other algorithm" refer to the >> compatibility hash algorithm specified by the compatObjectFormat >> extension and the "current" algorithm refers to the objectFormat >> extension? > > The "current algorithm" is usually the main algorithm (that is, SHA-256 > where `extensions.objectformat` is `sha256`) and the "other algorithm" > is the compatibility algorithm (SHA-1 in that case). However, when you > convert that object to SHA-1 to hash it in SHA-1, the "current > algorithm" becomes SHA-1 and the "other algorithm" is SHA-256. > > Does that make sense? Let me see if I got it right by trying to paraphrase the above. For any object that is suitable to be stored in a repository with objectFormat and compatObjectFormat set, "current" is the former, and "the other" is the latter. Your goal is not educating me, though. I wanted to make sure that the text would be understood by the target audience of this document in a way you intended it to be. Thanks.