From 77237f16821ca9403cfc8a7fcdddf129b23a363c Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sun, 25 Oct 2026 13:06:39 -1000
Subject: Fold a tag's signature away under its message

The armour ran on for more lines than most tag messages, as part of the
message itself. git finds the signature for every kind it can sign
with, so PGP, SSH and X.509 all fold the same way.
---
 tests/t0005-markup.sh | 21 +++++++++++++++++++++
 tests/t0113-tag.sh    | 31 +++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)

(limited to 'tests')

diff --git a/tests/t0005-markup.sh b/tests/t0005-markup.sh
index 5d802a7..0ba8ded 100755
--- a/tests/t0005-markup.sh
+++ b/tests/t0005-markup.sh
@@ -194,4 +194,25 @@ test_expect_success 'embedded mode marks the root' '
 	grep "<div id=.cgit. class=.cgit-embedded. data-page=.summary." tmp
 '
 
+test_expect_success 'a signed tag folds its signature away' '
+	(
+		cd repos/hooks &&
+		{
+			echo "object $(git rev-parse HEAD)" &&
+			echo "type commit" &&
+			echo "tag signed" &&
+			echo "tagger C O Mitter <committer@example.com> 1700000000 +0000" &&
+			echo &&
+			echo "Signed" &&
+			echo &&
+			echo "-----BEGIN SSH SIGNATURE-----" &&
+			echo "U1NIU0lH" &&
+			echo "-----END SSH SIGNATURE-----"
+		} >signed-tag &&
+		git update-ref refs/tags/signed $(git mktag <signed-tag)
+	) &&
+	hooks "hooks/tag/&h=signed" >tmp &&
+	grep "<details class=.signature.><summary>Signature</summary>" tmp
+'
+
 test_done
diff --git a/tests/t0113-tag.sh b/tests/t0113-tag.sh
index ff50f90..ec6f3c3 100755
--- a/tests/t0113-tag.sh
+++ b/tests/t0113-tag.sh
@@ -59,4 +59,35 @@ test_expect_success 'a tag of anything but a commit offers no download' '
 	grep ">download<" tmp
 '
 
+# git reads the signature off the end of a tag's message, so a block shaped
+# like one is enough to show it is folded away, with nothing to verify.
+test_expect_success 'a signed tag folds its signature after the message' '
+	(
+		cd repos/foo &&
+		{
+			echo "object $(git rev-parse HEAD)" &&
+			echo "type commit" &&
+			echo "tag signed" &&
+			echo "tagger C O Mitter <committer@example.com> 1700000000 +0000" &&
+			echo &&
+			echo "Signed release" &&
+			echo &&
+			echo "Notes." &&
+			echo &&
+			echo "-----BEGIN PGP SIGNATURE-----" &&
+			echo "iQEzBAABCAAdFiEE" &&
+			echo "-----END PGP SIGNATURE-----"
+		} >signed-tag &&
+		git update-ref refs/tags/signed $(git mktag <signed-tag)
+	) &&
+	cgit_url "foo/tag/&h=signed" >tmp &&
+	tr -d "\n" <tmp >flat &&
+	grep "<div class=.commit-msg.>Notes.</div><details class=.signature.><summary>Signature</summary><pre>-----BEGIN PGP SIGNATURE-----iQEzBAABCAAdFiEE-----END PGP SIGNATURE-----</pre></details>" flat
+'
+
+test_expect_success 'an unsigned tag has no fold' '
+	cgit_url "foo/tag/&h=v1.0" >tmp &&
+	! grep "details class=.signature." tmp
+'
+
 test_done
-- 
cgit 2.9.2