Re: Tags

[ebiederm@xmission.com (Eric W. Biederman)]

"H. Peter Anvin" <hpa@zytor.com> writes:

> Eric W. Biederman wrote:
>> If I really care what developer xyz tagged I will pull from them,
>> or a mirror I trust.  And since developer xyz doesn't pull his
>> own global tags from other repositories that should be sufficient.
>>
>
> You're missing something totally and utterly fundamental here: I'm talking about
> creating an infrastructure (think sourceforge) where there is only one git
> repository for the whole system, period, full stop, end of story.

Could be I'm certainly not up to speed on git yet.

However all you have to do for your single system git repository is
to filter tags at creation time.  So for a person to upload something
you need a git aware tool and you need authentication so you are certain
it is the right person creating the tag.  

Since it is a shared repository you probably want rules like you can
only create tags that belong to yourself or are owned by people 
who do not have accounts on the system.

Likewise in a system like sourceforge it is desirable to check all
of the committer information in commits as well, so you have a reasonable
audit trail, and it make sense to check little things like the file under
a sha1 key actually matches the sha1 key.

Downstream mirrors can happily rsync just fine.  So long as they
verify the upstream source.

Tags that you mirror are of course suspect but they will always be.
The primary tags created by people with accounts should be reliable
though.

So in essence I see nothing with my proposal that is any worse than
any other part of git.

That being said, it sounds like there is a slightly more git 
knowledgeable/native version suggested having to do with multiple
heads.

Eric