open/ktg-plugin-marketplace
1
0
Fork 0
Code Issues Releases Activity

docs(catalog): rett signatur-påstanden — git tag -a er SSH-signert, ikke usignert

Browse source 
CLAUDE.md sa at probe-taggen fra 2026-08-17 «came out unsigned all the same
(0 PGP blocks)». Det var en defekt i MÅLINGEN: ~/.gitconfig setter
gpg.format=ssh, så signaturen er en SSH-signatur og PGP-telling leser 0 på en
fullt signert tagg.

Re-målt i ferskt temp-repo: `git tag -a` gir 0 BEGIN PGP, 1 BEGIN SSH
SIGNATURE. Live-taggen llm-security v8.0.0 bærer samme SSH-signatur.

Forgejo viser likevel «ingen kjent nøkkel for denne signaturen» fordi
signeringsnøkkelen ikke er registrert som verifiseringsnøkkel på kontoen —
taggen er signert, men ingenting oppstrøms kan sjekke den. Signering er
dessuten ortogonalt til TAG-ANNOTATED: det er `-a` som gjør taggen til et
ekte tag-objekt, ikke signaturen.

Verifiseringsloven ansikt 4, i denne filas egne notater.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-18 01:15:52 +02:00
commit bf1d913c21
1 changed files with 14 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

17
CLAUDE.md
View file

@ -58,9 +58,20 @@ their own Forgejo repositories under `https://git.fromaitochitta.com/open/`.
"we decided this" / "nobody looked" collapse the register exists to prevent, one level up. The fix
belongs in repo-standard, not here — reported, not patched.
Note: `~/.gitconfig` sets `tag.gpgsign true`, which makes a bare `git tag <name>` **fail**
("no tag message?") rather than silently cut a lightweight one. Measured 2026-08-17, the probe's
`-a` tag came out **unsigned** all the same (0 PGP blocks) — so this config is an accident that
happens to block one path, not a signing guarantee. Do not treat it as the enforcement.
("no tag message?") rather than silently cut a lightweight one.
**CORRECTED 2026-09-18 — annotated tags on this machine ARE signed.** The 2026-08-17 note here
said the probe's `-a` tag "came out unsigned all the same (0 PGP blocks)". That was a defect in
the MEASUREMENT, not a fact about the tag: `~/.gitconfig` sets `gpg.format ssh` with
`user.signingkey ~/.ssh/id_ed25519.pub`, so the signature is an **SSH** signature and counting
PGP blocks reads 0 on a perfectly signed tag. Re-probed in a fresh temp repo: `git tag -a` →
**0 `BEGIN PGP`, 1 `BEGIN SSH SIGNATURE`**. The live `llm-security` `v8.0.0` tag object carries
the same SSH signature. Verifiseringsloven ansikt 4 in this repo's own notes — "found nothing"
was the wrong question asked, not an absence.
**What this still does NOT buy:** Forgejo shows "no known key found for this signature in the
database" on the release page, because the signing key is not registered as a *verification*
key on the Forgejo account. The tag is signed; nothing upstream can check it. And signing is
orthogonal to `TAG-ANNOTATED`: it is the `-a` that makes the tag a real tag object, not the
signature. Do not treat `tag.gpgsign` as the enforcement for annotation.
- **Releasing a plugin (canonical path — `scripts/release-plugin.mjs`):** since the polyrepo split,
a release is a TWO-repo act — tag the plugin repo AND bump the catalog `ref`. Forgetting the second
step strands users on the old version (the exact drift this helper exists to prevent). Run