GNU bug report logs - #24461
Signing Emacs git release tags

Previous Next

To reply to this bug, email your comments to 24461 AT debbugs.gnu.org.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Rob Browning <rlb <at> defaultvalue.org>
To: submit <at> debbugs.gnu.org 
Subject: Signing Emacs git release tags
Date: Sun, 18 Sep 2016 13:12:22 -0500

Package: emacs
Severity: wishlist

Please consider creating signed git release tags, i.e. "git tag -s
... emacs-25.2".

Thanks
-- 
Rob Browning
rlb @defaultvalue.org and @debian.org
GPG as of 2011-07-10 E6A9 DA3C C9FD 1FF8 C676 D2C4 C0F0 39E9 ED1B 597A
GPG as of 2002-11-03 14DD 432F AE39 534D B592 F9A0 25C8 D377 8C7E 73A4

Message #8 received at 24461 <at> debbugs.gnu.org (full text, mbox):

From: John Wiegley <jwiegley <at> gmail.com>
To: Rob Browning <rlb <at> defaultvalue.org>
Cc: Nicolas Petton <nicolas <at> petton.fr>, 24461 <at> debbugs.gnu.org
Subject: Re: bug#24461: Signing Emacs git release tags
Date: Sun, 18 Sep 2016 12:49:40 -0700

>>>>> "RB" == Rob Browning <rlb <at> defaultvalue.org> writes:

RB> Please consider creating signed git release tags, i.e. "git tag -s ...
RB> emacs-25.2".

I would like to see that as well. I assume it's too late to sign the 25.1 tag.

-- 
John Wiegley                  GPG fingerprint = 4710 CF98 AF9B 327B B80F
http://newartisans.com                          60E1 46C4 BD1A 7AC1 4BA2

Message #11 received at 24461 <at> debbugs.gnu.org (full text, mbox):

From: Nicolas Petton <nicolas <at> petton.fr>
To: John Wiegley <jwiegley <at> gmail.com>, Rob Browning <rlb <at> defaultvalue.org>
Cc: 24461 <at> debbugs.gnu.org
Subject: Re: bug#24461: Signing Emacs git release tags
Date: Sun, 18 Sep 2016 23:09:53 +0200

[Message part 1 (text/plain, inline)]

John Wiegley <jwiegley <at> gmail.com> writes:

> RB> Please consider creating signed git release tags, i.e. "git tag -s ...
> RB> emacs-25.2".
>
> I would like to see that as well. I assume it's too late to sign the
> 25.1 tag.

True, I think it's too late.  My commits (including the one used for the
release) should all be signed though.

Cheers,
Nico

[signature.asc (application/pgp-signature, inline)]

Message #14 received at 24461 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Kangas <stefan <at> marxist.se>
To: Nicolas Petton <nicolas <at> petton.fr>
Cc: John Wiegley <jwiegley <at> gmail.com>, 24461 <at> debbugs.gnu.org,
 Rob Browning <rlb <at> defaultvalue.org>
Subject: Re: bug#24461: Signing Emacs git release tags
Date: Sun, 29 Sep 2019 06:26:38 +0200

Nicolas Petton <nicolas <at> petton.fr> writes:

> John Wiegley <jwiegley <at> gmail.com> writes:
>
>> RB> Please consider creating signed git release tags, i.e. "git tag -s ...
>> RB> emacs-25.2".
>>
>> I would like to see that as well. I assume it's too late to sign the
>> 25.1 tag.
>
> True, I think it's too late.  My commits (including the one used for the
> release) should all be signed though.

How about signing the release tags from 27.1 and onwards?

Best regards,
Stefan Kangas

Message #17 received at 24461 <at> debbugs.gnu.org (full text, mbox):

From: Rob Browning <rlb <at> defaultvalue.org>
To: Stefan Kangas <stefan <at> marxist.se>, Nicolas Petton <nicolas <at> petton.fr>
Cc: John Wiegley <jwiegley <at> gmail.com>, 24461 <at> debbugs.gnu.org
Subject: Re: bug#24461: Signing Emacs git release tags
Date: Sun, 29 Sep 2019 11:05:40 -0500

Stefan Kangas <stefan <at> marxist.se> writes:

> Nicolas Petton <nicolas <at> petton.fr> writes:

>> True, I think it's too late.  My commits (including the one used for the
>> release) should all be signed though.
>
> How about signing the release tags from 27.1 and onwards?

Hmm, hadn't thought about this -- I don't know what git would do if you
changed an unsigned tag to a signed tag without changing the hash.  At a
minimum, I'd guess that people that already have the tag wouldn't fetch
the new one, but I don't know what else, if anything, git might do about
it (warn, fail, nothing, ...).

And of course, you wouldn't want to rely on whatever current git does
about it, unless that were upstream's intended/documented behavior.

(I suppose if it were deemed important enough, emacs-X.Y-sig tags or
 something could be added for older releases, though the meaning of
 those tags might be somewhat different.)

In any case, after originally filing this, I noticed that you had signed
commits, and I just rely on those now.  So while it might still be nice
to have signed tags (too), it's not all that important to me anymore.

Thanks
-- 
Rob Browning
rlb @defaultvalue.org and @debian.org
GPG as of 2011-07-10 E6A9 DA3C C9FD 1FF8 C676 D2C4 C0F0 39E9 ED1B 597A
GPG as of 2002-11-03 14DD 432F AE39 534D B592 F9A0 25C8 D377 8C7E 73A4

Message #20 received at 24461 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Kangas <stefan <at> marxist.se>
To: Rob Browning <rlb <at> defaultvalue.org>
Cc: John Wiegley <jwiegley <at> gmail.com>, Nicolas Petton <nicolas <at> petton.fr>,
 24461 <at> debbugs.gnu.org
Subject: Re: bug#24461: Signing Emacs git release tags
Date: Sun, 29 Sep 2019 18:22:06 +0200

Rob Browning <rlb <at> defaultvalue.org> writes:

> In any case, after originally filing this, I noticed that you had signed
> commits, and I just rely on those now.  So while it might still be nice
> to have signed tags (too), it's not all that important to me anymore.

I think signing tags is different than signing commits.  A signed tag
means you can have more trust that you are using the code with the
latest fix to security problem X, announced to have been released in
tagged Emacs version Y, and not code missing that fix.

Best regards,
Stefan Kangas

Message #23 received at 24461 <at> debbugs.gnu.org (full text, mbox):

From: Rob Browning <rlb <at> defaultvalue.org>
To: Stefan Kangas <stefan <at> marxist.se>
Cc: John Wiegley <jwiegley <at> gmail.com>, Nicolas Petton <nicolas <at> petton.fr>,
 24461 <at> debbugs.gnu.org
Subject: Re: bug#24461: Signing Emacs git release tags
Date: Sun, 29 Sep 2019 12:24:16 -0500

Stefan Kangas <stefan <at> marxist.se> writes:

> I think signing tags is different than signing commits.  A signed tag
> means you can have more trust that you are using the code with the
> latest fix to security problem X, announced to have been released in
> tagged Emacs version Y, and not code missing that fix.

Fair enough -- I suppose without the signed tag, there's no way to be
completely sure that you have the right signed commit.

-- 
Rob Browning
rlb @defaultvalue.org and @debian.org
GPG as of 2011-07-10 E6A9 DA3C C9FD 1FF8 C676 D2C4 C0F0 39E9 ED1B 597A
GPG as of 2002-11-03 14DD 432F AE39 534D B592 F9A0 25C8 D377 8C7E 73A4

Message #26 received at 24461 <at> debbugs.gnu.org (full text, mbox):

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: Rob Browning <rlb <at> defaultvalue.org>
Cc: Stefan Kangas <stefan <at> marxist.se>, 24461 <at> debbugs.gnu.org
Subject: Re: bug#24461: Signing Emacs git release tags
Date: Mon, 24 Jan 2022 11:38:48 +0100

Rob Browning <rlb <at> defaultvalue.org> writes:

> Please consider creating signed git release tags, i.e. "git tag -s
> ... emacs-25.2".

It's my understanding that we're going to start doing this starting with
emacs-28.1, but I may be misremembering.  Stefan?

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Message #31 received at 24461 <at> debbugs.gnu.org (full text, mbox):

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: Rob Browning <rlb <at> defaultvalue.org>
Cc: Stefan Kangas <stefan <at> marxist.se>, 24461 <at> debbugs.gnu.org
Subject: Re: bug#24461: Signing Emacs git release tags
Date: Mon, 21 Feb 2022 15:26:50 +0100

Lars Ingebrigtsen <larsi <at> gnus.org> writes:

> Rob Browning <rlb <at> defaultvalue.org> writes:
>
>> Please consider creating signed git release tags, i.e. "git tag -s
>> ... emacs-25.2".
>
> It's my understanding that we're going to start doing this starting with
> emacs-28.1, but I may be misremembering.  Stefan?

Yes, this is planned, but hasn't been implemented yet, as far as I can
tell from the make-tarball.txt file...

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.