Re: [PATCH 3/9] docs: reflect actual double signature for tags

On Sat, Sep 20, 2025 at 03:29:06PM +0000, brian m. carlson wrote:

On 2025-09-19 at 22:34:02, Junio C Hamano wrote:

quoted

"brian m. carlson" [off-list ref] writes:

quoted

+an in-body signature and a gpgsig-sha256 header for the SHA-1 format of an
+object or both an in-body signature and a gpgsig header for the SHA-256 format
+of and object.
 
-This means tags can be signed
+The signed payload of the tag is the content of the tag in the current
+algorithm with both its gpgsig and gpgsig-sha256 fields and

My reading of the previous paragraph is that we cannot have gpgsig
and gpgsig-sha256 fields on a single object at the same time.

Correct, unless we come up with a third hash algorithm.  Hopefully that
is a long way away, and we are not considering that case here.

You mentioned a "missed patch" in the commit message. So is this design
here intentional or merely an oversight?

I'm mostly asking because it feels weird to me that an object shouldn't
have both fields. I would assume that it's easier to implement and
reason about if this signature always was a header, or multiple that is.
But I'm not familiar enough with the logic here to really judge, so I
assume that there are good reasons that I miss.

Patrick