Re: Tags

Eric W. Biederman wrote:

There is a question of how bad is this.   For releases you certainly
need some kind of signature that people can verify and we
already have that but I think we can keep spoofing tags
down to the same level as spoofing patches.

Basically all this takes is to make your global namespace
the committer email address and you have the rule that
you can only tag your own commits.  Then when you merge
tags you never automatically add tags to your own tag namespace.

Doesn't work.  You can trivially generate a key with someone else's 
address.  It would require a full PKI.

	-hpa