Please use annotated or signed tags for releases

[dregad]

Greetings,

Would it be possible for you guys to consistently tag releases (at least future ones), using either annotated (git tag -a) or signed (git tag -s) tags ?

I'm using PHPMailer as a git submodule. When checking submodule status, git relies on git describe to retrieve the version number, which by default only shows annotated tags. This results in incorrectly reporting the PHPmailer version as 5.2.9, which is the most recent signed tag:

$ git submodule status -- phpmailer
+1d85f9ef3ecfc42bbc4f3c70d5e37ca9a65f629a phpmailer (v5.2.9-344-g1d85f9e)
$ cat phpmailer/VERSION
5.2.16

Use of annotated vs lightweight tags seems to be a somewhat random act at the moment, as shown in the table below (data was extracted with git tag | xargs -I% -n1 bash -c 'echo -n "% | "; git cat-file -t %'):

tag	type
phpmailer-2.0.3	tag
phpmailer-2.3.0	tag
phpmailer-2.3.0@186	tag
phpmailer-5.0.0	tag
phpmailer-5.0.2	tag
phpmailer-5.1	tag
v2.0.3	tag
v2.2.1	tag
v2.3.0	tag
v5.0.0	tag
v5.0.2	tag
v5.1.0	tag
v5.2.10	commit
v5.2.11	commit
v5.2.12	commit
v5.2.13	commit
v5.2.14	commit
v5.2.15	commit
v5.2.16	commit
v5.2.4	tag
v5.2.5	commit
v5.2.6	tag
v5.2.7	tag
v5.2.8	commit
v5.2.9	tag
v6.0.0rc1	commit
v6.0.0rc2	commit

where type is either

• tag = signed or annotated, or
• commit = lightweight tag

Thanks in advance !

[Synchro]

This is really a GitHub problem - all the release tags since 5.2.9 have been made with GitHub's release creation system - I can never remember git syntax and always seem to make a mess (if you look carefully you'll find tags with 4 or 5 attempts to set them correctly), so I simply avoid it.

[Synchro]

Composer doesn't have an issue with this - is there any reason you're using submodules rather than composer?

[dregad]

I didn't realize that you were creating the tags via the Github releases interface. I guess that explains why they sometimes get rewritten...

I wrote to Github support to request that they consider use of annotated/signed tags with their releases system, we'll see what they say.

With regards to the syntax, it's not hard, really...

git tag -a -m "Message"

I'm not sure how composer deals with this, but the problem with submodules is the fact they use git describe to show version information, which only shows lightweight tags unless you use the --all or --tags option. That may be something that should be fixed in git, I don't know.

As to why we're using submodules and not composer, that's a legacy issue. We might make the switch at some point, but for now there are other priorities.

[dregad]

I contacted Github support about this:

Would it be possible that the git tags created via Github releases are created as annotated (or even better, signed) tags instead of lightweight ones as is currently the case ?

The release title and/or description should be used for the tag's message.

Lightweight tags are more limited in functionality (e.g. they don't show up by default when using git describe), and I find it useful to have releases identified as their own object in the git repo instead of just a reference to a commit.

Since you now support signed commits, it would make sense to allow signed tags too.

Thanks in advance for considering this feature request.

Here is the feedback I got

This isn't currently possible but I do think it would be really useful to be able to create releases with annotated tags.

I've added it to our Feature Request. [emphasis mine]

As a workaround you can create annotated signed tags via the command and push it up to the repository.
When creating a release you should then be able to choose this tag from the list.

Hope this helps and please let me know if you need anything else!

Thanks
Stacey

[Luisinho77]

Hi!
Some of my friends think that's really interesting, check it out http://phijeslydy.asianhealthrecipes.com/e4lyx

Take care, ljlorente