threads / discuss / 22281

why is tagger header optional?

Subject: why is tagger header optional?

## tl;dr

6 messages between Jan 19, 2010 and Jan 19, 2010.

replies: 5people: 3as markdown or json

Shawn O. Pearce· Jan 19, 2010, 06:09 UTC · lore
So why is it legal to omit the tagger header from a tag?

E.g. the Linux kernel tag v2.6.12 has no tagger header: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tag;h=26791a8bcf0e6d33f43aef7682bdb555236d56de

JGit is currently failing on this tag, because its fsck implementation demands that a tag have a tagger header that can be parsed as a person identity.

Looking at tag.c's parse_tag_buffer(), the variable sig_line seems to be expected to point at the "tagger " header (given its name), but its not actually validated as such.

Is there a version of Git floating around that doesn't create a tagger header when creating a signed tag? WTF?

-- 
Shawn.
Junio C Hamano· Jan 19, 2010, 06:31 UTC · re: Shawn O. Pearce · lore

Re: why is tagger header optional?

"Shawn O. Pearce" <spearce@spearce.org> writes:
> So why is it legal to omit the tagger header from a tag?
>
> E.g. the Linux kernel tag v2.6.12 has no tagger header:

We didn't.add tagger line until c818566 ([PATCH] Update tags to record who made them, 2005-07-14), which is v0.99.1~9

Linux 2.6.12 is a lot older than that. v2.6.13-rc4 in late July is the first one with tagger.

Shawn O. Pearce· Jan 19, 2010, 06:32 UTC · re: Junio C Hamano · lore

Re: why is tagger header optional?

Junio C Hamano <gitster@pobox.com> wrote:
Show 11 quoted lines
> "Shawn O. Pearce" <spearce@spearce.org> writes:
> 
> > So why is it legal to omit the tagger header from a tag?
> >
> > E.g. the Linux kernel tag v2.6.12 has no tagger header:
> 
> We didn't.add tagger line until c818566 ([PATCH] Update tags to record who
> made them, 2005-07-14), which is v0.99.1~9
> 
> Linux 2.6.12 is a lot older than that.  v2.6.13-rc4 in late July is the
> first one with tagger.

Ugh. So its like the 100640 or whatever mode tags in the kernel trees that are also considered bogus by today's standards, but have to be allowed because of the kernel history.

Thanks.
-- 
Shawn.
Junio C Hamano· Jan 19, 2010, 06:35 UTC · re: Shawn O. Pearce · lore

Re: why is tagger header optional?

"Shawn O. Pearce" <spearce@spearce.org> writes:
Show 16 quoted lines
> Junio C Hamano <gitster@pobox.com> wrote:
>> "Shawn O. Pearce" <spearce@spearce.org> writes:
>> 
>> > So why is it legal to omit the tagger header from a tag?
>> >
>> > E.g. the Linux kernel tag v2.6.12 has no tagger header:
>> 
>> We didn't.add tagger line until c818566 ([PATCH] Update tags to record who
>> made them, 2005-07-14), which is v0.99.1~9
>> 
>> Linux 2.6.12 is a lot older than that.  v2.6.13-rc4 in late July is the
>> first one with tagger.
>
> Ugh.  So its like the 100640 or whatever mode tags in the kernel
> trees that are also considered bogus by today's standards, but have
> to be allowed because of the kernel history.

Yeah; don't we have "fsck --strict" or something to take the distinction into account, though? I don't recall if lack of tagger triggers the check offhand and I am too lazy to check.

Shawn O. Pearce· Jan 19, 2010, 06:37 UTC · re: Junio C Hamano · lore

Re: why is tagger header optional?

Junio C Hamano <gitster@pobox.com> wrote:
Show 21 quoted lines
> "Shawn O. Pearce" <spearce@spearce.org> writes:
> > Junio C Hamano <gitster@pobox.com> wrote:
> >> "Shawn O. Pearce" <spearce@spearce.org> writes:
> >> 
> >> > So why is it legal to omit the tagger header from a tag?
> >> >
> >> > E.g. the Linux kernel tag v2.6.12 has no tagger header:
> >> 
> >> We didn't.add tagger line until c818566 ([PATCH] Update tags to record who
> >> made them, 2005-07-14), which is v0.99.1~9
> >> 
> >> Linux 2.6.12 is a lot older than that.  v2.6.13-rc4 in late July is the
> >> first one with tagger.
> >
> > Ugh.  So its like the 100640 or whatever mode tags in the kernel
> > trees that are also considered bogus by today's standards, but have
> > to be allowed because of the kernel history.
> 
> Yeah; don't we have "fsck --strict" or something to take the distinction
> into account, though?  I don't recall if lack of tagger triggers the check
> offhand and I am too lazy to check.

I don't think it does under --strict. But yea, we do have --strict for the non-kernel repositories.

This came up because Gerrit Code Review asks JGit to do fsck during receive of objects from a client, JGit's tag fsck is too strict and demands a "tagger " header, but someone was trying to push this old tag from the Linux kernel into an empty repository.

I'll have to relax our tag fsck code in JGit and make the header optional.

-- 
Shawn.
Jeff King· Jan 19, 2010, 06:44 UTC · re: Shawn O. Pearce · lore

Re: why is tagger header optional?

On Mon, Jan 18, 2010 at 10:09:46PM -0800, Shawn O. Pearce wrote:
> So why is it legal to omit the tagger header from a tag?
> 
> E.g. the Linux kernel tag v2.6.12 has no tagger header:

I think you just answered your own question. We must support tagger-less tags because they exist in important projects like the kernel. :)

> [...]
> Is there a version of Git floating around that doesn't create a
> tagger header when creating a signed tag?  WTF?

Everything prior to c818566 ([PATCH] Update tags to record who made them, 2005-07-14). So probably nothing that anybody is using now, but v2.6.12 was one of the first tags made.

> Looking at tag.c's parse_tag_buffer(), the variable sig_line seems
> to be expected to point at the "tagger " header (given its name),
> but its not actually validated as such.

Actually, that variable name predates the patch above, so I suspect "sig" meant "GPG signature". At any rate, as you can see, git doesn't verify it, and the code for "git show v2.6.12" in builtin-log.c:show_object handles the taggerless case as well. I don't think anything else actually looks at the tagger. verify-tag treats the signed data as opaque, and just shows the identity of the actual signer.

-Peff

← back to recent threads