Subject: Re: [PATCH] push --signed: tighten what the receiving end can ask to sign

From: Jeff King <[email-masked]>
Date: Thu, 2 Apr 2015 18:16:03 -0400

On Thu, Apr 02, 2015 at 03:09:15PM -0700, Junio C Hamano wrote:

> +		if (isalnum(ch) ||
> +		    ch == '-' || ch == '.' ||
> +		    ch == '/' || ch == '+' ||
> +		    ch == '=' || ch == '_')
> +			continue;

I think this looks good. Earlier I suggested reducing the set of
allowable punctuation characters, but if we want to allow base64, that's
"+/=" right there. We use "-" ourselves, leaving only "." and "_" as
possible extras. But both of those are as useful as "-" for separators,
and are fairly innocuous, so I don't mind leaving them.

-Peff