From: Andreas Gal <gal@uci.edu>
To: Fabian Franz <FabianFranz@gmx.de>
Cc: Linus Torvalds <torvalds@osdl.org>,
David Woodhouse <dwmw2@infradead.org>,
Jan Dittmer <jdittmer@ppp0.net>, Greg KH <greg@kroah.com>,
Git Mailing List <git@vger.kernel.org>
Subject: Re: Git-commits mailing list feed.
Date: Sat, 23 Apr 2005 16:16:49 -0700 (PDT) [thread overview]
Message-ID: <Pine.LNX.4.58.0504231602010.28584@sam.ics.uci.edu> (raw)
In-Reply-To: <200504231950.43903.FabianFranz@gmx.de>
I would prefer a generic mechanism to sign _any_ object, not just tag
objects:
- Introduce "signature objects" that contains an implementation-specific
signature. git doesn't care about the content, as long some script can
verify that the signature in the signature object matches the content of
the object(s) it references. The "name" of a signature object is the
SHA1 hash of the content (=gpg signature, for example).
- Referencing signatures in tags makes no sense IMO, because it would
require to change the (hash) name of tags when someone else wants to
co-sign it later on. I would just distribute two names for that (here is
tag xxxxx and its signature is yyyyy). Tags should only contain a
symbolic name and the hash of the commit object they point to.
- A nice benefit of this is that we could sign unnamed commits (think
automatic signing of intermediate commit), or even sign individual
files in the tree.
Just my 2c.
Andreas
On Sat, 23 Apr 2005, Fabian Franz wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Am Samstag, 23. April 2005 19:31 schrieb Linus Torvalds:
> > On Sun, 24 Apr 2005, David Woodhouse wrote:
> > > Nah, asking Linus to tag his releases is the most comfortable way.
> > >
> > The reason I've not done tags yet is that I haven't decided how to do
> > them.
> >
> > commit a2755a80f40e5794ddc20e00f781af9d6320fafb
> > tag v2.6.12-rc3
> > signer Linus Torvalds
> >
> > This is my official original 2.6.12-rc2 release
> >
> > -----BEGIN PGP SIGNATURE-----
> > ....
> > -----END PGP SIGNATURE-----
> >
> > If somebody writes a script to generate the above kind of thing (and tells
> > me how to validate it), I'll do the rest, and start tagging things
> > properly. Oh, and make sure the above sounds sane (ie if somebody has a
> > better idea for how to more easily identify how to find the public key to
> > check against, please speak up).
>
> To generate those you do:
>
> # cat unsigned_tag
>
> commit a2755a80f40e5794ddc20e00f781af9d6320fafb
> tag v2.6.12-rc3
> signer Linus Torvalds
> This is my official original 2.6.12-rc2 release
>
> # gpg --clearsign < unsigned_tag > signed_tag # gpg will ask here for the
> secret key phrase
>
> To verify you do:
>
> # gpg --verify < signed_tag
>
> and check exit status.
>
> Hope that helps,
>
> cu
>
> Fabian
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.4 (GNU/Linux)
>
> iD8DBQFCaorzI0lSH7CXz7MRAr3QAJ45f2CQTgJ0sYfF9kRyrWHbsazVQQCeMqW7
> HCsah/llt/I8sQ36dlDnRWg=
> =Fgq1
> -----END PGP SIGNATURE-----
>
> -
> To unsubscribe from this list: send the line "unsubscribe git" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
next prev parent reply other threads:[~2005-04-23 23:12 UTC|newest]
Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <200504210422.j3L4Mo8L021495@hera.kernel.org>
[not found] ` <1114079347.6277.29.camel@laptopd505.fenrus.org>
2005-04-21 12:23 ` Git-commits mailing list feed David Woodhouse
[not found] ` <42674724.90005@ppp0.net>
[not found] ` <20050422002922.GB6829@kroah.com>
[not found] ` <426A4669.7080500@ppp0.net>
[not found] ` <1114266083.3419.40.camel@localhost.localdomain>
[not found] ` <426A5BFC.1020507@ppp0.net>
[not found] ` <1114266907.3419.43.camel@localhost.localdomain>
2005-04-23 17:31 ` Linus Torvalds
2005-04-23 17:45 ` Linus Torvalds
2005-04-23 17:50 ` Fabian Franz
2005-04-23 23:16 ` Andreas Gal [this message]
2005-04-23 17:50 ` Sean
2005-04-23 19:02 ` Thomas Glanzmann
2005-04-23 18:14 ` Sean
2005-04-23 19:34 ` Linus Torvalds
2005-04-23 17:54 ` Thomas Glanzmann
2005-04-23 18:30 ` Linus Torvalds
2005-04-23 18:06 ` Sean
2005-04-23 19:38 ` Linus Torvalds
2005-04-23 18:44 ` Sean
2005-04-23 19:58 ` Linus Torvalds
2005-04-23 19:57 ` Junio C Hamano
2005-04-23 20:23 ` Linus Torvalds
2005-04-23 20:24 ` Junio C Hamano
2005-04-24 23:25 ` Paul Jakma
2005-04-24 23:57 ` Paul Jakma
2005-04-25 1:01 ` David A. Wheeler
2005-04-25 1:35 ` Paul Jakma
2005-04-25 2:13 ` David A. Wheeler
2005-04-25 3:03 ` Paul Jakma
2005-04-25 3:08 ` Paul Jakma
2005-04-25 1:50 ` Linus Torvalds
2005-04-25 2:17 ` Fabian Franz
2005-04-25 2:39 ` Andreas Gal
2005-04-25 2:44 ` Linus Torvalds
2005-04-25 3:32 ` David A. Wheeler
2005-04-25 9:31 ` David Greaves
2005-04-25 3:08 ` David A. Wheeler
2005-04-25 3:24 ` Paul Jakma
2005-04-25 3:40 ` Paul Jakma
2005-04-25 3:47 ` Paul Jakma
2005-04-25 4:39 ` [PATCH] New option (-H) for rpush/rpull to update HEAD Andreas Gal
2005-04-25 4:47 ` Daniel Barkalow
2005-04-25 4:55 ` Andreas Gal
2005-04-25 5:18 ` Daniel Barkalow
2005-04-25 2:34 ` Git-commits mailing list feed Matt Domsch
2005-04-25 2:43 ` Jan Harkes
2005-04-23 18:39 ` Thomas Glanzmann
2005-04-23 18:44 ` Thomas Glanzmann
2005-04-23 18:46 ` Jan Harkes
2005-04-23 20:01 ` Linus Torvalds
2005-04-23 18:54 ` Junio C Hamano
2005-04-23 18:34 ` Jan Harkes
2005-04-23 19:30 ` Linus Torvalds
2005-04-23 20:49 ` Jan Harkes
2005-04-23 21:28 ` Git transfer protocols (was: Re: Git-commits mailing list feed) Mike Taht
2005-04-23 22:22 ` Jan Harkes
2005-04-23 23:29 ` Git-commits mailing list feed Linus Torvalds
2005-04-23 19:30 ` Suggestion: generalize signed tags into "assertion objects" David A. Wheeler
2005-04-23 20:15 ` Git-commits mailing list feed Jeff Garzik
2005-04-25 1:26 ` David Woodhouse
[not found] <3WtO4-5GW-5@gated-at.bofh.it>
[not found] ` <3WtXG-5Nh-9@gated-at.bofh.it>
[not found] ` <3WtXG-5Nh-7@gated-at.bofh.it>
[not found] ` <3WwLT-848-13@gated-at.bofh.it>
[not found] ` <3WxeV-5S-9@gated-at.bofh.it>
[not found] ` <3WxHT-pv-1@gated-at.bofh.it>
[not found] ` <3Wyb3-Sj-33@gated-at.bofh.it>
[not found] ` <3WyDZ-1a6-7@gated-at.bofh.it>
[not found] ` <3WYRN-5lJ-9@gated-at.bofh.it>
[not found] ` <3X0gU-6u6-5@gated-at.bofh.it>
[not found] ` <3X1G1-7ug-9@gated-at.bofh.it>
2005-04-25 15:47 ` Bodo Eggert <harvested.in.lkml@posting.7eggert.dyndns.org>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.58.0504231602010.28584@sam.ics.uci.edu \
--to=gal@uci.edu \
--cc=FabianFranz@gmx.de \
--cc=dwmw2@infradead.org \
--cc=git@vger.kernel.org \
--cc=greg@kroah.com \
--cc=jdittmer@ppp0.net \
--cc=torvalds@osdl.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).