commit 06714b03a48c3e2a8567f35937ba0eab06bb7a8d
from: Josh Rickmar <jrick@zettaport.com>
via: Thomas Adam <thomas@xteddy.org>
date: Fri Sep 02 15:54:01 2022 UTC

Do not segfault verifying "lightweight" tags

ok stsp@

commit - df9fed0915a99336775c645ff1d463846095c554
commit + 06714b03a48c3e2a8567f35937ba0eab06bb7a8d
blob - 150fdbe702f1959dfe51bf03f8550c054ee87e2a
blob + aca2d5adf35ad2c6712c336412f7a7312483a91b
--- got/got.c
+++ got/got.c
@@ -7043,7 +7043,7 @@ list_tags(struct got_repository *repo, const char *tag
 				break;
 		}
 
-		if (verify_tags) {
+		if (tag && verify_tags) {
 			ssh_sig = got_sigs_get_tagmsg_ssh_signature(
 			    got_object_tag_get_message(tag));
 			if (ssh_sig && allowed_signers == NULL) {
blob - b0593d23ccabf692437ea2a4e5550470e381b567
blob + d81b04d9a95f8ff34160c87f92d9bd2fa3dc56df
--- regress/cmdline/tag.sh
+++ regress/cmdline/tag.sh
@@ -259,6 +259,9 @@ test_tag_list_lightweight() {
 
 	got tag -r $testroot/repo -l > $testroot/stdout
 
+	# test signature validation ignoring lightweight tags
+	got tag -r $testroot/repo -V > $testroot/stdout
+
 	echo "-----------------------------------------------" \
 		> $testroot/stdout.expected
 	echo "tag $tag2 $tag_id2" >> $testroot/stdout.expected