backdated tag bug

backdated tag bug

[Eric Blake]

According to 'git tag --help', it should be possible to create a signed, back-
dated tag.  But I can't get it to work.  Am I doing something wrong, or is this 
a git bug?  Shell transcript follows:

# Done on a demo repository, although I encountered the bug on a real one.
# I plan on creating two revisions, then tagging the first v1 OLDER than
# the second at v2

$ mkdir foo
$ cd foo
$ git --version
git version 1.5.5
$ git init
Initialized empty Git repository in .git/
$ echo hi > file
$ git add file
$ git commit -m commit1
Created initial commit 617ff6a: commit1
 1 files changed, 1 insertions(+), 0 deletions(-)
 create mode 100644 file
$ echo bye > file
$ git commit -a -m commit2
Created commit 3f226cf: commit2
 1 files changed, 1 insertions(+), 1 deletions(-)

# Create a tag right now, for comparison purposes

$ git tag -s v2 -m v2  

You need a passphrase to unlock the secret key for
user: "Eric Blake (free software programmer) <ebb9@byu.net>"
1024-bit DSA key, ID F4850180, created 2004-12-18

$ git cat-file tag v2
object 3f226cf9b3905b60310866ab7a72c744f0f1feb4
type commit
tag v2
tagger Eric Blake <ebb9@byu.net> 1207943097 -0600

v2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Cygwin)
Comment: Public key at home.comcast.net/~ericblake/eblake.gpg

iEYEABECAAYFAkf/v7kACgkQ84KuGfSFAYA4ygCcDwGYnyWBanfQyZPInKrMluYu
m4AAnjQi/TQ+14MDtBeo3MrrpSQXoJnN
=HAcH
-----END PGP SIGNATURE-----

# Make sure I know how to get an older date

$ date '+%F %R'
2008-04-11 13:47
$ date '+%F %R' -d '-1 day'
2008-04-10 13:47

# Now, follow the advice in 'git tag --help'

$ GIT_AUTHOR_DATE=`date '+%F %R' -d '-1 day'` git tag -s v1 -m v1 HEAD^

You need a passphrase to unlock the secret key for
user: "Eric Blake (free software programmer) <ebb9@byu.net>"
1024-bit DSA key, ID F4850180, created 2004-12-18

$ git cat-file tag v1
object 617ff6a0daf5b9a32732bb79ef98f2abd3cd58de
type commit
tag v1
tagger Eric Blake <ebb9@byu.net> 1207943332 -0600

v1
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Cygwin)
Comment: Public key at home.comcast.net/~ericblake/eblake.gpg

iEYEABECAAYFAkf/wKQACgkQ84KuGfSFAYBGKACfdWzVMRgaLZImxj8IMMEDDOZr
z38An2WotiiskR+uXaIVglR6zX0mYFGD
=WEKw
-----END PGP SIGNATURE-----

# Hey wait a minute - 1207943097 is older than 1207943332.
# Which means v1 wasn't back-dated the way I asked :(
# Just to double-check with some human-readable times...

$ git tag -v v1 v2 2>&1 | grep -B1 made
v1
gpg: Signature made Fri Apr 11 13:48:52 2008 MDT using DSA key ID F4850180
--
v2
gpg: Signature made Fri Apr 11 13:44:57 2008 MDT using DSA key ID F4850180

# Oh well, I give up - 'git tag --help' lied about creating signed back-dated
# annotated tags. Since the porcelain didn't work, I'll try the plumbing.

$ git tag -d v1
Deleted tag 'v1'
$ emacs t
$ cat t
object 617ff6a0daf5b9a32732bb79ef98f2abd3cd58de
type commit
tag v1
tagger Eric Blake <ebb9@byu.net> `date +%s -d '-1 day'` -0600

v1
$ echo `git mktag < t` > .git/refs/tags/v1
$ git show v1 | head
tag v1
Tagger: Eric Blake <ebb9@byu.net>
Date:   Thu Apr 10 14:02:15 2008 -0600

v1
commit 617ff6a0daf5b9a32732bb79ef98f2abd3cd58de
Author: Eric Blake <ebb9@byu.net>
Date:   Fri Apr 11 13:40:17 2008 -0600

    commit1

# Better than nothing - I created a valid, annotated, back-dated tag.  But it
# isn't signed.  So let's try again:

$ gpg --clearsign t

You need a passphrase to unlock the secret key for
user: "Eric Blake (free software programmer) <ebb9@byu.net>"
1024-bit DSA key, ID F4850180, created 2004-12-18

$ echo `git mktag < t.asc` > .git/refs/tags/v1
error: char0: does not start with "object "
fatal: invalid tag signature file

# The plumbing doesn't like the BEGIN PGP SIGNED line, so I'll just strip it:

$ echo `tail -n+4 t.asc | git mktag` > .git/refs/tags/v1
$ git show v1 | head -n15
tag v1
Tagger: Eric Blake <ebb9@byu.net>
Date:   Thu Apr 10 14:02:15 2008 -0600

v1
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Cygwin)
Comment: Public key at home.comcast.net/~ericblake/eblake.gpg

iEYEARECAAYFAkf/xIMACgkQ84KuGfSFAYC8egCfZAFQ5LSnUPELCjifsr1DQKrE
PCUAoIGzd6pApwZNaaHuhO6miggycF1d
=qCJn
-----END PGP SIGNATURE-----
commit 617ff6a0daf5b9a32732bb79ef98f2abd3cd58de
Author: Eric Blake <ebb9@byu.net>

# There.  That worked - a back-dated signed tag!  Or did it?

$ git tag -v v1
object 617ff6a0daf5b9a32732bb79ef98f2abd3cd58de
type commit
tag v1
tagger Eric Blake <ebb9@byu.net> 1207857735 -0600

v1
gpg: Signature made Fri Apr 11 14:05:23 2008 MDT using DSA key ID F4850180
gpg: BAD signature from "Eric Blake (free software programmer) <ebb9@byu.net>"
error: could not verify the tag 'v1'

# Shoot.  I got the signature wrong.  The help on 'git mktag --help' mentions
# that tags can be signed, but *does not say how to use gpg to get to that
# point*.  I suppose I could read the source code, but I really expected that
# the manual would tell me how.  On the other hand, I guess I can live with
# leaving the 'git mktag' documentation alone if the original 'git tag' bug
# is fixed.

# Side note - while investigating this, I found another instance where the
# ui could be improved.  Compare the difference between annotated and
# lightweight tags:

$ git tag -m v3 v3
$ git tag v4
$ git tag -v v3
object 3f226cf9b3905b60310866ab7a72c744f0f1feb4
type commit
tag v3
tagger Eric Blake <ebb9@byu.net> 1207945051 -0600

v3
gpg: no valid OpenPGP data found.
gpg: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.
error: could not verify the tag 'v3'

# Why'd we get all the way to gpg?  Shouldn't git be smart enough to realize
# that there is no 'BEGIN PGP SIGNATURE', and not waste the time calling gpg?

$ git tag -v v4
error: 3f226cf9b3905b60310866ab7a72c744f0f1feb4: cannot verify a non-tag object 
of type commit.
error: could not verify the tag 'v4'

# Make up your mind.  Is v4 "a non-tag object" or "tag 'v4'"?  I think it
# would be nicer if git could tell me something like:
error: tag 'v3' is not signed
error: tag 'v4' is not annotated or signed

-- 
Eric Blake

Re: backdated tag bug

[Linus Torvalds]

On Fri, 11 Apr 2008, Eric Blake wrote:
>
> According to 'git tag --help', it should be possible to create a signed, back-
> dated tag.  But I can't get it to work.  Am I doing something wrong, or is this 
> a git bug?  Shell transcript follows:

Tags don't have an "author". They have a "tagger", and it's taken from the 
normal committer information. So you should use GIT_COMMITTER_DATE instead 
of GIT_AUTHOR_DATE and it should work.

		Linus

[PATCH] Fix section about backdating tags in the git-tag docs

[Björn Steinbrink]

The tagger is equal to the committer, not the author, so
GIT_COMMITTER_DATE is the right environment variable to use, not
GIT_AUTHOR_DATE.

Signed-off-by: Björn Steinbrink <B.Steinbrink@gmx.de>
---
 Documentation/git-tag.txt |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Documentation/git-tag.txt b/Documentation/git-tag.txt
index 4b6fd90..9712392 100644
--- a/Documentation/git-tag.txt
+++ b/Documentation/git-tag.txt
@@ -233,14 +233,14 @@ the tag object affects, for example, the ordering of tags in the
 gitweb interface.
 
 To set the date used in future tag objects, set the environment
-variable GIT_AUTHOR_DATE to one or more of the date and time.  The
+variable GIT_COMMITTER_DATE to one or more of the date and time.  The
 date and time can be specified in a number of ways; the most common
 is "YYYY-MM-DD HH:MM".
 
 An example follows.
 
 ------------
-$ GIT_AUTHOR_DATE="2006-10-02 10:31" git tag -s v1.0.1
+$ GIT_COMMITTER_DATE="2006-10-02 10:31" git tag -s v1.0.1
 ------------
 
 
-- 
1.5.5.rc3.7.gba133

Re: backdated tag bug

[Eric Blake]

Linus Torvalds <torvalds <at> linux-foundation.org> writes:

> > According to 'git tag --help', it should be possible to create a signed, 
back-
> > dated tag.  But I can't get it to work.  Am I doing something wrong, or is 
this 
> > a git bug?  Shell transcript follows:
> 
> Tags don't have an "author". They have a "tagger", and it's taken from the 
> normal committer information. So you should use GIT_COMMITTER_DATE instead 
> of GIT_AUTHOR_DATE and it should work.

Thanks.  At first, I thought it failed: the only human-readable date string in 
the output of 'git tag -v v1' was the date of the gpg signature, which was of 
course today.  But on closer inspection, the raw seconds listing in the tagger 
line was indeed older, and 'git show v1' shows the desired human-readable back-
date of yesterday.  So, can we get the 'git tag' documentation fixed to mention 
GIT_COMMITTER_DATE, and can 'git tag -v' be improved to show the tagger date in 
human-readable form?

And I still think it would be nice if 'git mktag --help' mentioned how to use 
gpg to create a valid signed tag, rather than just vaguely stating that it can 
be done, since I couldn't figure out how to create a tag signature file that 
would pass subsequent verification.

-- 
Eric Blake