averello/git-mirror
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2025-12-12 20:36:24 +01:00
Code Issues Packages Projects Releases Wiki Activity

docs: reflect actual double signature for tags

Browse Source 
The documentation for the hash function transition reflects the original
design where the SHA-256 signature would always be placed in a header.
However, due to a missed patch in Git 2.29, we shipped SHA-256 support
such that the signature for the current algorithm is always an in-body
signature and the opposite algorithm is always in a header.  Since the
documentation is inaccurate, update it to reflect the correct
information.

Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
brian m. carlson
2025-10-09 21:56:20 +00:00
committed by Junio C Hamano
parent 6947ed321d
commit d477892b30
1 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
Documentation/technical/hash-function-transition.adoc
View File

@@ -429,17 +429,19 @@ ordinary unsigned commit.
Signed Tags
~~~~~~~~~~~
We add a new field "gpgsig-sha256" to the tag object format to allow
signing tags without relying on SHA-1. Its signed payload is the
SHA-256 content of the tag with its gpgsig-sha256 field and "-----BEGIN PGP
SIGNATURE-----" delimited in-body signature removed.
We add new fields "gpgsig" and "gpgsig-sha256" to the tag object format to
allow signing tags in both formats. The in-body signature is used for the
signature in the current hash algorithm and the header is used for the
signature in the other algorithm. Thus, a dual-signature tag will contain both
an in-body signature and a gpgsig-sha256 header for the SHA-1 format of an
object or both an in-body signature and a gpgsig header for the SHA-256 format
of and object.
This means tags can be signed
The signed payload of the tag is the content of the tag in the current
algorithm with both its gpgsig and gpgsig-sha256 fields and
"-----BEGIN PGP SIGNATURE-----" delimited in-body signature removed.
1. using SHA-1 only, as in existing signed tag objects
2. using both SHA-1 and SHA-256, by using gpgsig-sha256 and an in-body
signature.
3. using only SHA-256, by only using the gpgsig-sha256 field.
This means tags can be signed using one or both algorithms.
Mergetag embedding
~~~~~~~~~~~~~~~~~~