docs: reflect actual double signature for tags
The documentation for the hash function transition reflects the original design where the SHA-256 signature would always be placed in a header. However, due to a missed patch in Git 2.29, we shipped SHA-256 support such that the signature for the current algorithm is always an in-body signature and the opposite algorithm is always in a header. Since the documentation is inaccurate, update it to reflect the correct information. Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
brian m. carlson committed
Oct 9, 2025 at 21:56 UTC
d477892b30b25333badb829190eb349fb671458c
1 file changed
+13
-11
Documentation/technical/hash-function-transition.adoc
+13
-11
@@ -429,17 +429,19 @@ ordinary unsigned commit.
429
430
Signed Tags
431
~~~~~~~~~~~
432
-We add a new field "gpgsig-sha256" to the tag object format to allow
433
-signing tags without relying on SHA-1. Its signed payload is the
434
-SHA-256 content of the tag with its gpgsig-sha256 field and "-----BEGIN PGP
435
-SIGNATURE-----" delimited in-body signature removed.
436
-
437
-This means tags can be signed
438
-
439
-1. using SHA-1 only, as in existing signed tag objects
440
-2. using both SHA-1 and SHA-256, by using gpgsig-sha256 and an in-body
441
- signature.
442
-3. using only SHA-256, by only using the gpgsig-sha256 field.
432
+We add new fields "gpgsig" and "gpgsig-sha256" to the tag object format to
433
+allow signing tags in both formats. The in-body signature is used for the
434
+signature in the current hash algorithm and the header is used for the
435
+signature in the other algorithm. Thus, a dual-signature tag will contain both
436
+an in-body signature and a gpgsig-sha256 header for the SHA-1 format of an
437
+object or both an in-body signature and a gpgsig header for the SHA-256 format
438
+of and object.
439
+
440
+The signed payload of the tag is the content of the tag in the current
441
+algorithm with both its gpgsig and gpgsig-sha256 fields and
442
+"-----BEGIN PGP SIGNATURE-----" delimited in-body signature removed.
443
+
444
+This means tags can be signed using one or both algorithms.
445
446
Mergetag embedding
447
~~~~~~~~~~~~~~~~~~