open/ktg-plugin-marketplace
1
0
Fork 0
Code Issues Releases Activity

docs(catalog): rett signatur-påstanden — git tag -a er SSH-signert, ikke usignert

Browse source 
CLAUDE.md sa at probe-taggen fra 2026-08-17 «came out unsigned all the same
(0 PGP blocks)». Det var en defekt i MÅLINGEN: ~/.gitconfig setter
gpg.format=ssh, så signaturen er en SSH-signatur og PGP-telling leser 0 på en
fullt signert tagg.

Re-målt i ferskt temp-repo: `git tag -a` gir 0 BEGIN PGP, 1 BEGIN SSH
SIGNATURE. Live-taggen llm-security v8.0.0 bærer samme SSH-signatur.

Forgejo viser likevel «ingen kjent nøkkel for denne signaturen» fordi
signeringsnøkkelen ikke er registrert som verifiseringsnøkkel på kontoen —
taggen er signert, men ingenting oppstrøms kan sjekke den. Signering er
dessuten ortogonalt til TAG-ANNOTATED: det er `-a` som gjør taggen til et
ekte tag-objekt, ikke signaturen.

Verifiseringsloven ansikt 4, i denne filas egne notater.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-18 01:15:52 +02:00
commit bf1d913c21
1 changed files with 14 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

17
CLAUDE.md
View file

@ -58,9 +58,20 @@ their own Forgejo repositories under `https://git.fromaitochitta.com/open/`.
"we decided this" / "nobody looked" collapse the register exists to prevent, one level up. The fix "we decided this" / "nobody looked" collapse the register exists to prevent, one level up. The fix
belongs in repo-standard, not here — reported, not patched. belongs in repo-standard, not here — reported, not patched.
Note: `~/.gitconfig` sets `tag.gpgsign true`, which makes a bare `git tag <name>` **fail** Note: `~/.gitconfig` sets `tag.gpgsign true`, which makes a bare `git tag <name>` **fail**
("no tag message?") rather than silently cut a lightweight one. Measured 2026-08-17, the probe's ("no tag message?") rather than silently cut a lightweight one.
`-a` tag came out **unsigned** all the same (0 PGP blocks) — so this config is an accident that **CORRECTED 2026-09-18 — annotated tags on this machine ARE signed.** The 2026-08-17 note here
happens to block one path, not a signing guarantee. Do not treat it as the enforcement. said the probe's `-a` tag "came out unsigned all the same (0 PGP blocks)". That was a defect in
the MEASUREMENT, not a fact about the tag: `~/.gitconfig` sets `gpg.format ssh` with
`user.signingkey ~/.ssh/id_ed25519.pub`, so the signature is an **SSH** signature and counting
PGP blocks reads 0 on a perfectly signed tag. Re-probed in a fresh temp repo: `git tag -a` →
**0 `BEGIN PGP`, 1 `BEGIN SSH SIGNATURE`**. The live `llm-security` `v8.0.0` tag object carries
the same SSH signature. Verifiseringsloven ansikt 4 in this repo's own notes — "found nothing"
was the wrong question asked, not an absence.
**What this still does NOT buy:** Forgejo shows "no known key found for this signature in the
database" on the release page, because the signing key is not registered as a *verification*
key on the Forgejo account. The tag is signed; nothing upstream can check it. And signing is
orthogonal to `TAG-ANNOTATED`: it is the `-a` that makes the tag a real tag object, not the
signature. Do not treat `tag.gpgsign` as the enforcement for annotation.
- **Releasing a plugin (canonical path — `scripts/release-plugin.mjs`):** since the polyrepo split, - **Releasing a plugin (canonical path — `scripts/release-plugin.mjs`):** since the polyrepo split,
a release is a TWO-repo act — tag the plugin repo AND bump the catalog `ref`. Forgetting the second a release is a TWO-repo act — tag the plugin repo AND bump the catalog `ref`. Forgetting the second
step strands users on the old version (the exact drift this helper exists to prevent). Run step strands users on the old version (the exact drift this helper exists to prevent). Run