Subject: Re: [PATCH 3/9] docs: reflect actual double signature for tags

From: "brian m. carlson" <[email-masked]>
Date: Sat, 20 Sep 2025 15:29:06 +0000

On 2025-09-19 at 22:34:02, Junio C Hamano wrote:
> "brian m. carlson" <[email-masked]> writes:
> 
> >  Signed Tags
> >  ~~~~~~~~~~~
> > +We add new fields "gpgsig" and "gpgsig-sha256" to the tag object format to
> > +allow signing tags in both formats.  The in-body signature is used for the
> > +signature in the current hash algorithm and the header is used for the
> > +signature in the other algorithm.  Thus, a dual-signature tag will contain both
> 
> Not suggesting a change in the text, but to make sure I am reading
> the new text correctly.  Does "the other algorithm" refer to the
> compatibility hash algorithm specified by the compatObjectFormat
> extension and the "current" algorithm refers to the objectFormat
> extension?

The "current algorithm" is usually the main algorithm (that is, SHA-256
where `extensions.objectformat` is `sha256`) and the "other algorithm"
is the compatibility algorithm (SHA-1 in that case).  However, when you
convert that object to SHA-1 to hash it in SHA-1, the "current
algorithm" becomes SHA-1 and the "other algorithm" is SHA-256.

Does that make sense?

> > +an in-body signature and a gpgsig-sha256 header for the SHA-1 format of an
> > +object or both an in-body signature and a gpgsig header for the SHA-256 format
> > +of and object.
> >  
> > -This means tags can be signed
> > +The signed payload of the tag is the content of the tag in the current
> > +algorithm with both its gpgsig and gpgsig-sha256 fields and
> 
> My reading of the previous paragraph is that we cannot have gpgsig
> and gpgsig-sha256 fields on a single object at the same time.

Correct, unless we come up with a third hash algorithm.  Hopefully that
is a long way away, and we are not considering that case here.

> Should we say "gpgsig or gpgsig-sha256" (instead of "and"), to get
> the resulting text parsable as:
> 
> 	both 
> 		its gpgsig or gpgsig-sha256 fields
> 	and
> 		"-----BEGIN PGP SIGNATURE-----" delimited in-body signature
> 	removed.
> 
> instead?

Sure, I'll include that in a reroll.
-- 
brian m. carlson (they/them)
Toronto, Ontario, CA