Re: [RFC/PATCH] verify-tag: add --check-name flag

[Jeff King <peff@peff.net>]

On Tue, Jun 07, 2016 at 02:05:20PM -0700, Junio C Hamano wrote:

> It is true that "git cat-file tag v1.4.11" lets you examine all
> lines of a given tag object, but the calling program needs to pick
> pieces apart with something like:
> 
> 	git cat-file tag v1.4.11 | sed -e '/^$/q' -e 's/^tag //p'
> 
> which may be cumbersome.  Perhaps, just like "git tag -v v1.4.11" is
> a way to see if the contents of the tag is signed properly, if you
> add "git tag --show-tagname v1.4.11" that does the above pipeline,
> these package managers and other tools can be updated to
> 
> 	tag="$1"
> -	if ! git tag -v "$tag"
> +	if ! git tag -v "$tag" ||
> +	   test "$tag" != "$(git tag --show-tagname $tag)"
>         then
> 		echo >&2 "Bad tag."
>                 exit 1
> 	fi
> 	make dest=/usr/local/$package/$tag install

That is much more flexible, as they could even do some more complicated
matching than a single string (though in practice, for security things,
I think simpler is better).

I think this option is going to become a blueprint for other "extended"
checks, too. E.g., you might also want to check that the tagger ident
matches the uid on the signing key.

My main worry is that we'll accrue a whole bunch of such logic. And even
though each one is relatively simple, it would be nice for callers to be
able to ask us to just do the standard safety checks.

If we do go with the "print it out and let the caller do their own
checks" strategy, I think I'd prefer rather than "--show-tagname" to
just respect the "--format" we use for tag-listing. That would let you
do:

  git tag -v --format='%(tag)%n%(tagger)'

or similar. In fact you can already do that with a separate step (modulo
%n, which we do not seem to understand here), but like your example:

> Or it could even do this:
> 
> 	tag="$1"
> 	if ! git tag -v "$tag"
> 	if ! git tag -v "$tag"
>         then
> 		echo >&2 "Bad tag."
>                 exit 1
> 	fi
> +	tag=$(git tag --show-tagname $tag)
> 	make dest=/usr/local/$package/$tag install

It is racy. That probably doesn't matter for most callers, but it would
be nice to be able to get a custom format out of the "-v" invocation.

-Peff