Re: Tags

[A Large Angry SCM <gitzilla@gmail.com>]

Linus Torvalds wrote:
> 
> On Sat, 2 Jul 2005, A Large Angry SCM wrote:
>>Why have tag objects at all?
> 
> Trust.
> 
> None of git itself normally has any "trust". The SHA1 means that the 
> _integrity_ of the archive is ensured, but for some things (notably 
> releases), you want to have something else. That's the "tag object".
> 

But can't the commit object do this just as well by signing the commit text?

> And I really should probably have called them something else. _I_
> personally tend to want to have a 1:1 relationship between my "tag
> references" (ie the 20-byte SHA1 pointer) and my "tag objects", but that's
> because my releases are things that I envision people may actually want to
> verify are mine.
> 

Your tendency is to use tag objects as a permanent, public label of some 
state. Signing the commit text or the email stating that commit 
${COMMIT_SHA} would work just as well for verification purposes. Or even 
a blob object containing the signed text "${COMMIT_SHA} is vX.X.X.X". 
Either way, you'd still need some kind of external reference to find the 
object.

> In many cases, you'd never use a "tag object", and the "tag reference" 
> would just point directly to a commit, with no extra indirect object.

Tag refs, like head refs and branches, are all just (temporary) 
notational shorthand to make using the tools easier.

The problem with the Borg repository is not the objects but the object 
refs. Isn't that just a namespace problem?