Congratulations! Missing 3.0.0 tag?

Steffen Nurpmeso steffen at sdaoden.eu
Thu Sep 9 19:25:47 UTC 2021


Randall S. Becker wrote in
 <012201d7a590$56df08d0$049d1a70$@nexbridge.com>:
 |On September 9, 2021 6:56 AM, Steffen Nurpmeso wrote:
 |>Benjamin Kaduk wrote in
 |> <20210908233639.GY19992 at akamai.com>:
 |>|On Thu, Sep 09, 2021 at 01:03:28AM +0200, Steffen Nurpmeso wrote:
 ...
 |>|I think (off the top of my head, i.e., without consulting a reference) \
 |>| |that `git log` (which your aliases end up at) will only
 |display
 |>|signatures on commits, but will not show the tag objects themselves.
 |>|`git show` does display the tag object, and for openssl only the \
 |>|tag  |object is what is signed; the commits themselves are not
 |signed.
 |>
 |>I see.  That is a logical one, thanks for the explanation.
 ...
 |$ git tag --verify openssl-3.0.0

Yes yes, ok!  But like i said, wouldn't it be nice if at least
release commits would be signed also, a.k.a./or when a new branch
is created?  In Linux for example the merge commits to the master
branch are signed, in addition to the tags of the actual releases.
It may even be a deja vu and i may have clamoured in the past.

 ...
 |Although I do not have Richard's public key on the system where I ran \
 |the command and GitHub is not showing the verification status
 |of the tag.

I do not know much about github.

In fact i did not even know that the Linux release commits are
_not_ signed, because if i look (what do _i_ know from the
kernel?) then i only look at master, and there you see signed
commits.  And since my url= is https i do not actually verify
tags.  (In fact it is automated and simply diff(1)s in the
difference to the version stated in the Makefile in
/usr/src/linux/.)  But true, the last merge before Linux 5.14 was
signed, but the creation of the linux-5.14.y branch not.
Ach, forget about the noise, i hope next time i finally have my
head turned on before i post :)

Thank you.

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)


More information about the openssl-users mailing list