Re: [PATCH/RFC] builtin/tag: Changes argument format for verify

[Jeff King <peff@peff.net>]

On Thu, Mar 03, 2016 at 05:05:03PM -0500, Santiago Torres wrote:

> I've been trying to shape these changes into sensible patch, but it is
> not as trivial as I originally thought. I think the issue lies in the
> tag desambiguation aspect of the git-tag command.
> 
> It seems that verify-tag can take either the refname or the hash of the
> object. However, git tag --verify takes only the refname, so it doesn't
> resolve the tag-sha1 if that's specified as an argument.

Right. Git-tag's arguments are tag-names, _not_ general sha1
expressions. So we look at "refs/tags/<whatever>", and nothing else. I
think this should remain the case. Even though it may seem like a
convenience to fall back to resolving the sha1, I think it introduces
unexpected corner cases.

> Also, would it make sense to remove the verify-tag command altogether?

No, I don't think so, for two reasons.

One is simply that it would break backwards compatibility. Verify-tag is
the advertised "plumbing" command for scripts to use, and we do not want
to break them. So even if its features were totally subsumed by "git tag
--verify", we would keep it anyway.

The second is that I don't think it is quite the same thing as "tag
--verify". Verify-tag is plumbing for operating on a tag object; that's
why it takes an arbitrary sha1 expression. But git-tag is a general
command for operating on tag-names defined in refs/tags. We've already
seen one difference there (how we resolve the arguments), but as time
goes on, there may be others. E.g., "tag --verify" may learn to validate
additional elements of the tag, like whether the refname matches what is
in the signed object (that's just an example; I don't know if it's a
good idea or not, but I just meant to illustrate the conceptual
difference between the two).

> On the same line, it seems that there used to be a --raw flag on the
> verify-tag command, should I propagate this to git tag --verify?

I'm not sure if it is necessary. It's primarily for machine consumption,
and in that case, I'd expect people to use the verify-tag plumbing.

-Peff