From 44747b64682355df7591f911bd8bb4e63613c34c Mon Sep 17 00:00:00 2001 From: Paul Bezilla Date: Sun, 6 Sep 2026 10:36:34 -0600 Subject: [PATCH] Strip a tag's signature before parsing its trailers A signed annotated tag appends its signature block straight after the message with no blank line between, so the last paragraph became message-plus-signature and did not parse as trailers at all. The tag-annotation check then passed on every signed tag, whatever it carried. capsize already had this; the hook shared by otel-service-reference, kubernetes-platform-reference and bezilla did not. Proved in a throwaway clone with real signed tags rather than by reading: existing tags still pass, a clean signed tag passes, and a signed tag carrying a disallowed trailer is rejected. --- .githooks/pre-push | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.githooks/pre-push b/.githooks/pre-push index e2d50d8..d43bec5 100755 --- a/.githooks/pre-push +++ b/.githooks/pre-push @@ -201,8 +201,14 @@ if [ -n "$tags" ]; then [ "$tagger" = "$CANONICAL" ] || fail "tag ${ref#refs/tags/} tagger is '${tagger}', expected '${CANONICAL}'" - # Everything after the header's blank line is the annotation body. - check_trailers "tag ${ref#refs/tags/}" "$(printf '%s\n' "$raw" | sed '1,/^$/d')" || exit 1 + # The annotation body is everything after the header's blank line, minus + # any signature. A signed tag appends its signature block straight after + # the message with no blank line between -- so the last paragraph becomes + # message-plus-signature, which does not parse as trailers and would make + # this check silently pass on every signed tag. Strip the signature, then + # parse. + body="$(printf '%s\n' "$raw" | sed '1,/^$/d' | sed '/^-----BEGIN .*SIGNATURE-----$/,$d')" + check_trailers "tag ${ref#refs/tags/}" "$body" || exit 1 done <<< "$tags" fi