Re: Tags

[ebiederm@xmission.com (Eric W. Biederman)]

"H. Peter Anvin" <hpa@zytor.com> writes:

> Eric W. Biederman wrote:
>> ?? Isn't that what ssh is?
>> To some extent a lot depends on how active you expect people to
>> try and forge things.  If there is an expectation of honesty
>> you are fine.
>
> I can't afford to have that.

So you are now your requirements are more stringent then sourceforge?
Sourcefore limited things by reducing the scope of commits per
project.  But once you had commit access to a project you could do
just about anything.

>> If you want to build one mondo repository with thousands of developers
>> having write access you need to be more careful.  But as far as I know
>> none of that is specific to tags.
>
> Well, you're wrong.  Tags is the only part of git which cannot be protected by
> git's own self-validation system.

Which is why I suggested having tags in sync with the committer
information, that way you are as valid as the commit record
in git.  Although I suspect the multiple head solution is
probably better, and simply limiting the people who can commit
to an individual head will achieve what is necessary.  One user
per head?

One thing arch has shown is that you can sucessfully move
authentication/permission checking to the underlying environment
if you structure things carefully.

I guess the problem is really we want to structure things so that
a user who has downloaded the code can verify they have the
release/tag is what they are looking for.  You can detect
a spoofed file in objects by simply verifying the sha1 of the file.

For a file that you can't internally verify that way the traditional
way to handle that is to create a file with a gpg signature.  So
is there anything wrong with adding .git/refs/tags/tag-name.sign
that is a traditional signature file?   That will at least give
you an end to end consistency check.  (Hmm.  Why didn't I suggest
this before?)

If you don't want to mirror and propagate data you need to do
consistency checks earlier in the process, and I have probably had
some poor suggestions on how to implement those.  But if everything
is setup so we can verify things once we have the code downloaded,
where you perform the checks is simply a matter of optimization.

Eric