GNU bug report logs - #24461
Signing Emacs git release tags

Previous Next

Full log

Message #17 received at 24461 <at> debbugs.gnu.org (full text, mbox):

From: Rob Browning <rlb <at> defaultvalue.org>
To: Stefan Kangas <stefan <at> marxist.se>, Nicolas Petton <nicolas <at> petton.fr>
Cc: John Wiegley <jwiegley <at> gmail.com>, 24461 <at> debbugs.gnu.org
Subject: Re: bug#24461: Signing Emacs git release tags
Date: Sun, 29 Sep 2019 11:05:40 -0500

Stefan Kangas <stefan <at> marxist.se> writes:

> Nicolas Petton <nicolas <at> petton.fr> writes:

>> True, I think it's too late.  My commits (including the one used for the
>> release) should all be signed though.
>
> How about signing the release tags from 27.1 and onwards?

Hmm, hadn't thought about this -- I don't know what git would do if you
changed an unsigned tag to a signed tag without changing the hash.  At a
minimum, I'd guess that people that already have the tag wouldn't fetch
the new one, but I don't know what else, if anything, git might do about
it (warn, fail, nothing, ...).

And of course, you wouldn't want to rely on whatever current git does
about it, unless that were upstream's intended/documented behavior.

(I suppose if it were deemed important enough, emacs-X.Y-sig tags or
 something could be added for older releases, though the meaning of
 those tags might be somewhat different.)

In any case, after originally filing this, I noticed that you had signed
commits, and I just rely on those now.  So while it might still be nice
to have signed tags (too), it's not all that important to me anymore.

Thanks
-- 
Rob Browning
rlb @defaultvalue.org and @debian.org
GPG as of 2011-07-10 E6A9 DA3C C9FD 1FF8 C676 D2C4 C0F0 39E9 ED1B 597A
GPG as of 2002-11-03 14DD 432F AE39 534D B592 F9A0 25C8 D377 8C7E 73A4

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.