Description
In http://git-blame.blogspot.fr/2012/01/using-signed-tag-in-pull-requests.html Junio explains:
Starting from Git release v1.7.9, a contributor can add a signed tag to the commit at the tip of the history and ask the integrator to pull that signed tag. When the integrator runs git pull, the signed tag is automatically verified to assure that the history is not tampered with. In addition, the resulting merge commit records the content of the signed tag, so that other people can verify that the branch merged by the integrator was signed by the contributor, without fetching the signed tag used to validate the pull request separately and keeping it in the refs namespace.
and later:
The resulting commit records the signed tag used for this validation in a hidden field so that it can later be used by others to audit the history.
Here's an example of such a commit taken from git.git:
$ git cat-file commit 8ead1bfe111085ef1ad7759e67340f074996b244
tree 3661c4d9524fc3be83c6eb2b242495785f08ecc1
parent 87a5461fa7b30f7b7baf27204f10219d61500fbf
parent f6dd784ed4c1705d465b1238f9a5971f2733e582
author Junio C Hamano <[email protected]> 1350514546 -0700
committer Junio C Hamano <[email protected]> 1350514546 -0700
mergetag object f6dd784ed4c1705d465b1238f9a5971f2733e582
type commit
tag gitgui-0.17.0
tagger Pat Thoyts <[email protected]> 1350507528 +0100
git-gui 0.17.0
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
iQCVAwUAUH8cCGB90JXwhOSJAQI2ywP+PPdCYqxkpGzYYQkf/ZU3JFBqJqSxQE6i
V4ROiW+iHaS5EqWt7GvXc0G5M8b+7M0TMtCjwozSD1ne+Ced+ZOfxqSUOgGQL2XD
Vc4nHsITLNkhlSYlRP6VqXLsuW47iq+Hw/LQcSBvG79A3ooSC1QktfKV2JmtqIxr
i6lfGwM7yT4=
=zifn
-----END PGP SIGNATURE-----
Merge tag 'gitgui-0.17.0' of git://repo.or.cz/git-gui
git-gui 0.17.0
* tag 'gitgui-0.17.0' of git://repo.or.cz/git-gui:
git-gui 0.17
git-gui: Don't prepend the prefix if value looks like a full path
git-gui: Detect full path when parsing arguments
git-gui: remove .git/CHERRY_PICK_HEAD after committing
git-gui: Fix a loose/lose mistake
git-gui: Fix semi-working shortcuts for unstage and revert
git-gui: de.po: translate "remote" as "extern"
git-gui: de.po: translate "bare" as "bloß"
git-gui: de.po: consistently add untranslated hook names within braces
git-gui: preserve commit messages in utf-8
git-gui: open console when using --trace on windows
git-gui: fix a typo in po/ files
git-gui: Use PWD if it exists on Mac OS X
git-gui: fix git-gui crash due to uninitialized variable
The mergetag field in the commit is actually a multiline field, with continuation lines starting with a single space character.
Git::PurePerl currently chokes on such a commit with the following error:
Use of uninitialized value $key in hash element at /tmp/git-pureperl/lib/Git/PurePerl/Object/Commit.pm line 37.
Use of uninitialized value $key in hash element at /tmp/git-pureperl/lib/Git/PurePerl/Object/Commit.pm line 37.
Can't locate object method "" via package "Git::PurePerl::Object::Commit" at /tmp/git-pureperl/lib/Git/PurePerl/Object/Commit.pm line 59.