Configuration, Aliases, Tags and Signing

$ git config list --show-scope --show-origin
global	file:$LAB/ch14b/scopes/home/.gitconfig	user.name=Lab User
global	file:$LAB/ch14b/scopes/home/.gitconfig	user.email=you@example.com
global	file:$LAB/ch14b/scopes/home/.gitconfig	init.defaultbranch=main
global	file:$LAB/ch14b/scopes/home/.gitconfig	gc.reflogexpire=never
global	file:$LAB/ch14b/scopes/home/.gitconfig	gc.reflogexpireunreachable=never
local	file:.git/config	core.repositoryformatversion=0
local	file:.git/config	core.filemode=true
local	file:.git/config	core.bare=false
local	file:.git/config	core.logallrefupdates=true
local	file:.git/config	core.ignorecase=true
local	file:.git/config	core.precomposeunicode=true

$ git config set --global pull.rebase true
$ git config set pull.rebase false
$ git config get pull.rebase
false
$ git config get --all --show-scope --show-origin pull.rebase
global	file:$LAB/ch14b/scopes/home/.gitconfig	true
local	file:.git/config	false

$ git -c pull.rebase=merges config get --show-scope --show-origin pull.rebase
command	command line:	merges
$ GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=pull.rebase GIT_CONFIG_VALUE_0=interactive git config get --show-scope --show-origin pull.rebase
command	command line:	interactive
$ GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=pull.rebase GIT_CONFIG_VALUE_0=interactive git -c pull.rebase=merges config get --all --show-scope pull.rebase
global	true
local	false
command	interactive
command	merges

# A stand-in for the system file, inside the sandbox. The real one is never read.
$ printf '[pull]\n\tff = only\n\trebase = interactive\n' > ~/etc-gitconfig
$ GIT_CONFIG_NOSYSTEM=0 GIT_CONFIG_SYSTEM=~/etc-gitconfig git var GIT_CONFIG_SYSTEM
$LAB/ch14b/scopes/home/etc-gitconfig
$ GIT_CONFIG_NOSYSTEM=0 GIT_CONFIG_SYSTEM=~/etc-gitconfig git config get --all --show-scope --show-origin --regexp "^pull\."
system	file:$LAB/ch14b/scopes/home/etc-gitconfig	only
system	file:$LAB/ch14b/scopes/home/etc-gitconfig	interactive
global	file:$LAB/ch14b/scopes/home/.gitconfig	true
local	file:.git/config	false
$ GIT_CONFIG_NOSYSTEM=0 GIT_CONFIG_SYSTEM=~/etc-gitconfig git config get --show-scope pull.rebase
local	false
$ git var GIT_CONFIG_SYSTEM
[exit status: 1]
$ git var GIT_CONFIG_GLOBAL
$LAB/ch14b/scopes/home/.gitconfig

# A second global file in the XDG location. Without GIT_CONFIG_GLOBAL, Git reads it and then ~/.gitconfig.
$ mkdir -p ~/.config/git
$ printf '[pull]\n\trebase = merges\n[core]\n\tabbrev = 12\n' > ~/.config/git/config
$ env -u GIT_CONFIG_GLOBAL git config get --all --show-scope --show-origin pull.rebase
global	file:$LAB/ch14b/scopes/home/.config/git/config	merges
global	file:$LAB/ch14b/scopes/home/.gitconfig	true
local	file:.git/config	false
$ env -u GIT_CONFIG_GLOBAL git config get --show-scope --show-origin core.abbrev
global	file:$LAB/ch14b/scopes/home/.config/git/config	12
$ git config get --all --show-scope --show-origin pull.rebase
global	file:$LAB/ch14b/scopes/home/.gitconfig	true
local	file:.git/config	false

$ git config set --worktree core.sparseCheckout true
$ git config list --local --show-scope --show-origin
local	file:.git/config	core.repositoryformatversion=0
local	file:.git/config	core.filemode=true
local	file:.git/config	core.bare=false
local	file:.git/config	core.logallrefupdates=true
local	file:.git/config	core.ignorecase=true
local	file:.git/config	core.precomposeunicode=true
local	file:.git/config	core.sparsecheckout=true
local	file:.git/config	pull.rebase=false
$ git config set extensions.worktreeConfig true
$ git config set --worktree core.sparseCheckout true
$ cat .git/config.worktree
[core]
	sparseCheckout = true
$ git config get --all --show-scope --show-origin core.sparseCheckout
local	file:.git/config	true
worktree	file:.git/config.worktree	true

   read first                                                        read last
   ----------------------------------------------------------------------------->
   system            global                    local          worktree      command
   $(prefix)/etc/    $XDG_CONFIG_HOME/git/     .git/config    .git/config.  -c key=value
   gitconfig         config, ~/.gitconfig                     worktree      GIT_CONFIG_COUNT

   single-valued key : the value read last wins
   multi-valued key  : all values from all files are used
   include.path      : the included file is read at the point of the include line

$ cd ~/work/inference-gateway
$ git config set core.editor "code --wait"
$ git var GIT_EDITOR
true
$ (unset GIT_EDITOR; git var GIT_EDITOR)
code --wait
$ (unset GIT_EDITOR; EDITOR=nano git var GIT_EDITOR)
code --wait
$ (unset GIT_EDITOR; git config unset core.editor; EDITOR=nano git var GIT_EDITOR)
nano
$ git var GIT_AUTHOR_IDENT
Lab User <you@example.com> 1788757980 +0530
$ git -c user.name="Set With -c" var GIT_AUTHOR_IDENT
Lab User <you@example.com> 1788758040 +0530
$ (unset GIT_AUTHOR_NAME; git -c user.name="Set With -c" var GIT_AUTHOR_IDENT)
Set With -c <you@example.com> 1788758100 +0530

$ cd ~
$ git config list --show-scope
global	user.name=Lab User
global	user.email=you@example.com
global	init.defaultbranch=main
global	gc.reflogexpire=never
global	gc.reflogexpireunreachable=never
global	pull.rebase=true
$ git config set pull.ff only
fatal: not in a git directory
[exit status: 128]
$ git config list --local
fatal: --local can only be used inside a git repository
[exit status: 128]

$ git config set merge.conflictStyle zdiff3
$ git config get merge.conflictStyle
zdiff3
$ git config get merge.conflictstyle
zdiff3
$ git config get merge.conflictStyl
[exit status: 1]
$ git config get --default merge merge.conflictStyl
merge
$ git config unset merge.conflictStyle
$ git config unset merge.conflictStyle
[exit status: 5]

# The same four operations with the flags that older scripts and tutorials use.
$ git config merge.conflictStyle zdiff3
$ git config merge.conflictStyle
zdiff3
$ git config --get merge.conflictStyle
zdiff3
$ git config --list --local | tail -1
merge.conflictstyle=zdiff3
$ git config --unset merge.conflictStyle

$ git config set --comment "decided 2026-09-07, see docs/git-setup.md" rebase.autoSquash true
$ git config set branch.release/1.2.description "Maintenance line for 1.2"
$ git config set credential.https://git.corp.example.username lab.user
$ tail -6 .git/config
[rebase]
	autoSquash = true # decided 2026-09-07, see docs/git-setup.md
[branch "release/1.2"]
	description = Maintenance line for 1.2
[credential "https://git.corp.example"]
	username = lab.user
$ git config list --local --name-only | tail -3
rebase.autosquash
branch.release/1.2.description
credential.https://git.corp.example.username
$ git config get --url=https://git.corp.example/platform/inference-gateway.git credential.username
lab.user
$ git config get --url=https://code.other.example/evalkit.git credential.username
[exit status: 1]

$ git config set core.bigFileThreshold 2g
$ git config get core.bigFileThreshold
2g
$ git config get --type=int core.bigFileThreshold
2147483648
$ git config set --global core.excludesFile "~/.config/git/ignore"
$ git config get core.excludesFile
~/.config/git/ignore
$ git config get --type=path core.excludesFile
$LAB/ch14b/config-commands/home/.config/git/ignore
$ printf '[rerere]\n\tenabled\n[fetch]\n\tprune = yes\n' >> .git/config
$ git config get --type=bool rerere.enabled
true
$ git config get --type=bool fetch.prune
true
$ git config get fetch.prune
yes
$ git config set --type=bool fetch.prune sometimes
fatal: bad boolean config value 'sometimes' for 'fetch.prune'
[exit status: 128]
$ git config get --type=bool core.bigFileThreshold
fatal: bad boolean config value '2g' for 'core.bigfilethreshold'
[exit status: 128]

$ git config set --append remote.origin.fetch "+refs/heads/*:refs/remotes/origin/*"
$ git config set --append remote.origin.fetch "+refs/pull/*/head:refs/remotes/origin/pr/*"
$ git config get remote.origin.fetch
+refs/pull/*/head:refs/remotes/origin/pr/*
$ git config get --all remote.origin.fetch
+refs/heads/*:refs/remotes/origin/*
+refs/pull/*/head:refs/remotes/origin/pr/*
$ git config set remote.origin.fetch "+refs/tags/*:refs/tags/*"
warning: remote.origin.fetch has multiple values
error: cannot overwrite multiple values with a single value
       Use --value=<pattern>, --append or --all to change remote.origin.fetch.
[exit status: 5]
$ git config unset remote.origin.fetch
warning: remote.origin.fetch has multiple values
[exit status: 5]
$ git config unset --value="refs/pull" remote.origin.fetch
$ git config get --all remote.origin.fetch
+refs/heads/*:refs/remotes/origin/*

$ git config get --all --show-names --regexp "^rebase\."
rebase.autosquash true
$ git help --config | grep "^rebase\."
rebase.abbreviateCommands
rebase.autoSquash
rebase.autoStash
rebase.backend
rebase.forkPoint
rebase.instructionFormat
rebase.maxLabelLength
rebase.missingCommitsCheck
rebase.rebaseMerges
rebase.rescheduleFailedExec
rebase.stat
rebase.updateRefs

$ git config set --global pull.rebsae true
$ git config get pull.rebsae
true
$ git config get pull.rebase
[exit status: 1]
$ git config set --global pull_rebase true
error: key does not contain a section: pull_rebase
[exit status: 2]
$ git config unset --global pull.rebsae

# Which file would each scope open? An "editor" that only prints its argument tells you.
$ GIT_EDITOR="echo would edit:" git config edit
would edit: $LAB/ch14b/config-commands/home/work/inference-gateway/.git/config
$ GIT_EDITOR="echo would edit:" git config edit --global
would edit: $LAB/ch14b/config-commands/home/.gitconfig
$ GIT_EDITOR="echo would edit:" git config edit --worktree
would edit: $LAB/ch14b/config-commands/home/work/inference-gateway/.git/config

$ printf '[alias\n\tst = status -sb\n' >> .git/config
$ git status
fatal: bad config line 19 in file .git/config
[exit status: 128]
$ git config list --local
fatal: bad config line 19 in file .git/config
[exit status: 128]
$ git config list --global
fatal: bad config line 19 in file .git/config
[exit status: 128]
$ git config edit
fatal: bad config line 19 in file .git/config
[exit status: 128]
# Git cannot repair it. A text tool on the named line can. Here: delete the two appended lines.
$ sed -i.bak -e '/^\[alias$/,$d' .git/config && rm .git/config.bak
$ git status -sb
## main

Observed behavior : every Git command in one repository fails with "fatal: bad config line 19
                    in file .git/config", including git config edit and git config list --global.
Git state         : objects, refs and index are intact. One line of .git/config is not valid syntax.
Mechanism         : every command reads the whole configuration before it does anything, and a
                    parse error in a file it must read is fatal.
Root cause        : a hand edit (here a section header without its closing bracket).
Why Git does this : running with half a configuration could mean the wrong identity, the wrong
                    remote or a skipped safety setting; refusing is the conservative choice.
Correct fix       : open the named file at the named line with a text editor, not with Git.
Prevention        : change settings with git config set; after a hand edit run git config list.

$ printf '[user]\n\temail = lab.user@corp.example\n' > ~/.gitconfig-work
$ git config set --global 'includeIf.gitdir:~/work/.path' '~/.gitconfig-work'
$ cat ~/.gitconfig
[user]
	name = Lab User
	email = you@example.com
[init]
	defaultBranch = main
[gc]
	reflogExpire = never
	reflogExpireUnreachable = never
[includeIf "gitdir:~/work/"]
	path = ~/.gitconfig-work

$ cd ~/work/inference-gateway
$ git config get --all --show-scope --show-origin user.email
global	file:$LAB/ch14b/includes/home/.gitconfig	you@example.com
global	file:$LAB/ch14b/includes/home/.gitconfig-work	lab.user@corp.example
$ git var GIT_AUTHOR_IDENT
Lab User <lab.user@corp.example> 1788756300 +0530
$ cd ~/oss/evalkit
$ git config get --all --show-scope --show-origin user.email
global	file:$LAB/ch14b/includes/home/.gitconfig	you@example.com
$ git var GIT_AUTHOR_IDENT
Lab User <you@example.com> 1788756480 +0530

$ cd ~/work/inference-gateway
$ printf 'timeout_seconds: 30\n' >> config/limits.yaml
$ git commit -q -am "Add request timeout"
$ git log -2 --format='%h  %an <%ae>  %s'
ad95595  Lab User <lab.user@corp.example>  Add request timeout
eb112a5  Lab User <you@example.com>  Add rate limits

  ~/.gitconfig                                    ~/.gitconfig-work
  +-----------------------------------+           +-----------------------------------+
  | [user]                            |           | [user]                            |
  |     name  = Lab User              |           |     email = lab.user@corp.example |
  |     email = you@example.com       |           +-----------------------------------+
  | [includeIf "gitdir:~/work/"]      |   read here, and only if the repository's
  |     path = ~/.gitconfig-work  ----+-->  .git directory is somewhere under ~/work/
  +-----------------------------------+

  reading order in ~/work/inference-gateway:  you@example.com, then lab.user@corp.example (wins)
  reading order in ~/oss/evalkit:             you@example.com (wins)

$ git config unset --global 'includeIf.gitdir:~/work/.path'
$ git config set --global 'includeIf.gitdir:~/work.path' '~/.gitconfig-work'
$ git config get user.email
you@example.com
$ git config unset --global 'includeIf.gitdir:~/work.path'
$ git config set --global 'includeIf.gitdir:~/work/.path' '~/.gitconfig-work'
$ git config get user.email
lab.user@corp.example

# The same two sections in the other order: the conditional include first, [user] after it.
$ cp ~/.gitconfig ~/.gitconfig.good
$ printf '[includeIf "gitdir:~/work/"]\n\tpath = ~/.gitconfig-work\n[user]\n\tname = Lab User\n\temail = you@example.com\n[init]\n\tdefaultBranch = main\n' > ~/.gitconfig
$ git config get --all --show-origin user.email
file:$LAB/ch14b/includes/home/.gitconfig-work	lab.user@corp.example
file:$LAB/ch14b/includes/home/.gitconfig	you@example.com
$ git config get user.email
you@example.com
$ mv ~/.gitconfig.good ~/.gitconfig
$ git config get user.email
lab.user@corp.example

$ cd ~/work
$ git config get user.email
you@example.com
$ git init -q rag-indexer
$ git -C rag-indexer config get user.email
lab.user@corp.example

$ git config set --global 'includeIf.gitdir:~/clients/.path' '~/.gitconfig-clients'
$ git init -q ~/clients/acme-chatbot
$ ls ~/.gitconfig-clients
ls: $LAB/ch14b/includes/home/.gitconfig-clients: No such file or directory
[exit status: 1]
$ git -C ~/clients/acme-chatbot config get --show-origin user.email
file:$LAB/ch14b/includes/home/.gitconfig	you@example.com

# Asking one scope by name switches include processing off unless you ask for it.
$ git config get --global user.email
you@example.com
$ git config get --global --includes user.email
lab.user@corp.example
$ git config list --global --show-origin | grep user
file:$LAB/ch14b/includes/home/.gitconfig	user.name=Lab User
file:$LAB/ch14b/includes/home/.gitconfig	user.email=you@example.com
$ git config list --global --includes --show-origin | grep user
file:$LAB/ch14b/includes/home/.gitconfig	user.name=Lab User
file:$LAB/ch14b/includes/home/.gitconfig	user.email=you@example.com
file:$LAB/ch14b/includes/home/.gitconfig-work	user.email=lab.user@corp.example

$ printf '[user]\n\temail = lab.user@corp.example\n' > ~/.gitconfig-corp-remote
$ git config set --global 'includeIf.hasconfig:remote.*.url:git@git.corp.example:platform/**.path' '~/.gitconfig-corp-remote'
$ git init -q ~/tmp/prompt-library
$ cd ~/tmp/prompt-library
$ git config get --show-origin user.email
file:$LAB/ch14b/includes/home/.gitconfig	you@example.com
$ git remote add origin git@git.corp.example:platform/prompt-library.git
$ git config get --show-origin user.email
file:$LAB/ch14b/includes/home/.gitconfig-corp-remote	lab.user@corp.example

$ cd ~/work/inference-gateway
$ printf '[merge]\n\tconflictStyle = zdiff3\n[rebase]\n\tupdateRefs = true\n' > .gitconfig-team
$ git config get merge.conflictStyle
[exit status: 1]
$ git config set include.path ../.gitconfig-team
$ git config get --show-scope --show-origin merge.conflictStyle
local	file:.git/../.gitconfig-team	zdiff3
$ git config list --local --includes --show-origin | tail -3
file:.git/config	include.path=../.gitconfig-team
file:.git/../.gitconfig-team	merge.conflictstyle=zdiff3
file:.git/../.gitconfig-team	rebase.updaterefs=true

$ git var GIT_DEFAULT_BRANCH
main
$ git config get --show-origin init.defaultBranch
file:$LAB/ch14b/settings/home/.gitconfig	main
# The same question with no global file at all, which is how unconfigured Git 2.55 answers:
$ GIT_CONFIG_GLOBAL=/dev/null git var GIT_DEFAULT_BRANCH
master

$ git stauts -sb
git: 'stauts' is not a git command. See 'git --help'.

The most similar command is
	status
[exit status: 1]
$ git -c help.autocorrect=never stauts -sb
git: 'stauts' is not a git command. See 'git --help'.
[exit status: 1]
$ git -c help.autocorrect=immediate stauts -sb
WARNING: You called a Git command named 'stauts', which does not exist.
Continuing under the assumption that you meant 'status'.
## main
 M gateway/retry.py
[exit status: 0]

$ git diff --stat
 gateway/retry.py | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)
$ git diff | tail -n +5
@@ -1,16 +1,16 @@
-def call_small(prompt):
-    for attempt in range(3):
+def call_large(prompt):
+    for attempt in range(5):
         try:
-            return small.complete(prompt)
+            return large.complete(prompt)
         except Timeout:
-            continue
-    raise Unavailable("small")
+            backoff(attempt)
+    raise Unavailable("large")
 
 
-def call_large(prompt):
+def call_small(prompt):
     for attempt in range(3):
         try:
-            return large.complete(prompt)
+            return small.complete(prompt)
         except Timeout:
             continue
-    raise Unavailable("large")
+    raise Unavailable("small")

$ git config set diff.algorithm histogram
$ git diff --stat
 gateway/retry.py | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)
$ git diff | tail -n +5
@@ -1,3 +1,12 @@
+def call_large(prompt):
+    for attempt in range(5):
+        try:
+            return large.complete(prompt)
+        except Timeout:
+            backoff(attempt)
+    raise Unavailable("large")
+
+
 def call_small(prompt):
     for attempt in range(3):
         try:
@@ -5,12 +14,3 @@ def call_small(prompt):
         except Timeout:
             continue
     raise Unavailable("small")
-
-
-def call_large(prompt):
-    for attempt in range(3):
-        try:
-            return large.complete(prompt)
-        except Timeout:
-            continue
-    raise Unavailable("large")

$ cat ~/.gitconfig
[user]
	name = Lab User
	email = you@example.com
	useConfigOnly = true # refuse to guess an identity
[init]
	defaultBranch = main
[gc]
	reflogExpire = never
	reflogExpireUnreachable = never
[pull]
	ff = only # never integrate by accident
[push]
	autoSetupRemote = true # first push sets the upstream
[fetch]
	prune = true # forget branches deleted on the server
[merge]
	conflictStyle = zdiff3 # show the common ancestor in conflicts
[rebase]
	autoSquash = true # fixup! commits find their place
	updateRefs = true # stacked branches move together
[rerere]
	enabled = true # remember conflict resolutions
[diff]
	algorithm = histogram # moved code reads as a move
	colorMoved = default
[help]
	autocorrect = prompt # show the suggestion, run nothing
[core]
	excludesFile = ~/.config/git/ignore

$ git config set --global alias.st 'status -sb'
$ git config set --global alias.lg 'log --graph --decorate --oneline --all'
$ git config set --global alias.last 'log -1 --stat HEAD'
$ git config set --global alias.unstage 'restore --staged --'
$ git config set --global alias.amend 'commit --amend --no-edit'
$ git config get --all --show-names --regexp "^alias\."
alias.st status -sb
alias.lg log --graph --decorate --oneline --all
alias.last log -1 --stat HEAD
alias.unstage restore --staged --
alias.amend commit --amend --no-edit

$ git st
## main
$ git lg
* 1adfaa7 (HEAD -> main) Raise the rate limit
| * f29324a (feature/fallback-route) Add fallback route
|/  
* eb112a5 Add rate limits
* 516c4c3 Add model router
* 37da450 Add README
$ git last
commit 1adfaa7ec5b01b116b6d926ce544561f6b29583d
Author: Lab User <you@example.com>
Date:   Mon Sep 7 10:09:00 2026 +0530

    Raise the rate limit

 config/limits.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

$ printf 'burst: 20\n' >> config/limits.yaml
$ printf 'scratch\n' > notes.txt
$ git add .
$ git st
## main
M  config/limits.yaml
A  notes.txt
$ git unstage notes.txt
$ git st
## main
M  config/limits.yaml
?? notes.txt

$ git log -1 --format="%h %s"
1adfaa7 Raise the rate limit
$ git amend
[main e1bef49] Raise the rate limit
 Date: Mon Sep 7 10:09:00 2026 +0530
 1 file changed, 2 insertions(+), 1 deletion(-)
$ git log -1 --format="%h %s"
e1bef49 Raise the rate limit
$ git show --stat --format="%h %s" HEAD
e1bef49 Raise the rate limit

 config/limits.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
$ git reflog -2
e1bef49 HEAD@{0}: commit (amend): Raise the rate limit
1adfaa7 HEAD@{1}: commit: Raise the rate limit

$ GIT_TRACE=1 git st 2>&1 | grep -E -o '(alias expansion|built-in): .*'
alias expansion: st => status -sb
built-in: git status -sb
$ GIT_TRACE=1 git lg -1 2>&1 | grep -E -o '(alias expansion|built-in): .*'
alias expansion: lg => log --graph --decorate --oneline --all
built-in: git log --graph --decorate --oneline --all -1

# Arguments after the alias name are appended to the expansion.
$ git lg -2
* e1bef49 (HEAD -> main) Raise the rate limit
| * f29324a (feature/fallback-route) Add fallback route
|/  
$ git last --format="%h %s" feature/fallback-route
e1bef49 Raise the rate limit

 config/limits.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
$ GIT_TRACE=1 git last --format='%h %s' feature/fallback-route 2>&1 | grep -E -o 'built-in: .*'
built-in: git log -1 --stat HEAD '--format=%h %s' feature/fallback-route
$ git config set --global alias.last 'log -1 --stat'
$ git last --format="%h %s" feature/fallback-route
f29324a Add fallback route

 gateway/router.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

$ git config set --global alias.root '!pwd'
$ cd gateway
$ git root
$LAB/ch14b/aliases/home/work/inference-gateway
$ git config set --global alias.where '!echo "prefix=$GIT_PREFIX top=$(pwd)"'
$ git where
prefix=gateway/ top=$LAB/ch14b/aliases/home/work/inference-gateway
$ cd ..

$ git config set --global alias.tracked '!git ls-tree -r --name-only $1 | head -2'
$ git tracked HEAD
head: HEAD: No such file or directory
[exit status: 1]
$ GIT_TRACE=1 git tracked HEAD 2>&1 | grep -o 'start_command: .*'
start_command: /bin/sh -c 'git ls-tree -r --name-only $1 | head -2 "$@"' 'git ls-tree -r --name-only $1 | head -2' HEAD
$ git config set --global alias.tracked '!f() { git ls-tree -r --name-only "${1:-HEAD}" | head -2; }; f'
$ git tracked HEAD
README.md
config/limits.yaml
$ git tracked feature/fallback-route
README.md
config/limits.yaml

$ git config set --global alias.status 'status -sb'
$ git status
On branch main
Untracked files:
  (use "git add <file>..." to include in what will be committed)
	notes.txt

nothing added to commit but untracked files present (use "git add" to track)
$ GIT_TRACE=1 git status 2>&1 | grep -E -o '(alias expansion|built-in): .*'
built-in: git status
$ git config unset --global alias.status

$ sed -n "/^\[alias\]/,\$p" ~/.gitconfig
[alias]
	st = status -sb
	lg = log --graph --decorate --oneline --all
	last = log -1 --stat
	unstage = restore --staged --
	amend = commit --amend --no-edit
	root = !pwd
	where = !echo \"prefix=$GIT_PREFIX top=$(pwd)\"
	tracked = "!f() { git ls-tree -r --name-only \"${1:-HEAD}\" | head -2; }; f"

$ GIT_TRACE=1 git st 2>&1 | grep -E -o '(trace: (exec|alias expansion|built-in)|##).*'
trace: exec: git-st
trace: alias expansion: st => status -sb
trace: exec: git status -sb
trace: built-in: git status -sb
## main

$ cd gateway
$ GIT_TRACE_SETUP=1 git st 2>&1 | grep -o 'setup: .*' | grep -v chdir
setup: git_dir: .git
setup: git_common_dir: .git
setup: worktree: $LAB/ch14b/diagnose-env/home/work/inference-gateway
setup: cwd: $LAB/ch14b/diagnose-env/home/work/inference-gateway
setup: prefix: gateway/
$ cd ..

# ~/lab-bin/ssh is a stand-in that prints its arguments and exits. No connection is made.
$ git remote add origin git@git.corp.example:platform/inference-gateway.git
$ GIT_SSH_COMMAND='~/lab-bin/ssh -i ~/.ssh/id_ed25519_work -o IdentitiesOnly=yes' git fetch origin
ssh was asked to run: -i $LAB/ch14b/diagnose-env/home/.ssh/id_ed25519_work -o IdentitiesOnly=yes -o SendEnv=GIT_PROTOCOL git@git.corp.example git-upload-pack 'platform/inference-gateway.git'
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
[exit status: 128]

$ git config set core.sshCommand '~/lab-bin/ssh -i ~/.ssh/id_ed25519_work'
$ git ls-remote origin
ssh was asked to run: -i $LAB/ch14b/diagnose-env/home/.ssh/id_ed25519_work -o SendEnv=GIT_PROTOCOL git@git.corp.example git-upload-pack 'platform/inference-gateway.git'
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
[exit status: 128]
$ GIT_SSH_COMMAND='~/lab-bin/ssh -v' git ls-remote origin
ssh was asked to run: -v -o SendEnv=GIT_PROTOCOL git@git.corp.example git-upload-pack 'platform/inference-gateway.git'
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
[exit status: 128]

GIT_TRACE_CURL=1 git ls-remote https://github.com/<owner>/<repo>.git
GIT_CURL_VERBOSE=1 git ls-remote https://github.com/<owner>/<repo>.git

$ git log --oneline
eb112a5 Add rate limits
516c4c3 Add model router
37da450 Add README
$ git tag staging-2026-09-07
$ cat .git/refs/tags/staging-2026-09-07
eb112a5c44b0b2092c4ef2cae6e75b16da000f73
$ git cat-file -t staging-2026-09-07
commit
$ git count-objects | cut -d, -f1
11 objects

$ git tag -a v1.0.0 -m "inference-gateway 1.0.0" -m "First release with rate limits."
$ git count-objects | cut -d, -f1
12 objects
$ cat .git/refs/tags/v1.0.0
b69624883fa40e51cbbf4c4baf49365ba1caa02e
$ git cat-file -t v1.0.0
tag
$ git cat-file -p v1.0.0
object eb112a5c44b0b2092c4ef2cae6e75b16da000f73
type commit
tag v1.0.0
tagger Lab User <you@example.com> 1788756060 +0530

inference-gateway 1.0.0

First release with rate limits.

$ git rev-parse v1.0.0 'v1.0.0^{tag}' 'v1.0.0^{commit}' 'v1.0.0^{}' 'v1.0.0^{tree}'
b69624883fa40e51cbbf4c4baf49365ba1caa02e
b69624883fa40e51cbbf4c4baf49365ba1caa02e
eb112a5c44b0b2092c4ef2cae6e75b16da000f73
eb112a5c44b0b2092c4ef2cae6e75b16da000f73
406c0291b052f665e4581982583c94937f169d80
$ git show-ref --tags --dereference
eb112a5c44b0b2092c4ef2cae6e75b16da000f73 refs/tags/staging-2026-09-07
b69624883fa40e51cbbf4c4baf49365ba1caa02e refs/tags/v1.0.0
eb112a5c44b0b2092c4ef2cae6e75b16da000f73 refs/tags/v1.0.0^{}
$ git for-each-ref refs/tags --format='%(refname:short) | %(objecttype) %(objectname:short) | peeled: %(*objecttype) %(*objectname:short)'
staging-2026-09-07 | commit eb112a5 | peeled:  
v1.0.0 | tag b696248 | peeled: commit eb112a5

  refs/tags/staging-2026-09-07 ----------------------------+
                                                           v
  refs/tags/v1.0.0 --> tag b696248                  commit eb112a5 <-- refs/heads/main <-- HEAD
                       object eb112a5 --------------^      |
                       type   commit                       v
                       tag    v1.0.0                   tree 406c029
                       tagger Lab User ... +0530
                       "inference-gateway 1.0.0"

$ git tag -a v0.9.0 -m "Internal preview" HEAD~1
$ git tag -m "Rate limits verified on staging" v1.0.0-verified
$ git tag -n1
staging-2026-09-07 Add rate limits
v0.9.0          Internal preview
v1.0.0          inference-gateway 1.0.0
v1.0.0-verified Rate limits verified on staging
$ git for-each-ref refs/tags --format='%(refname:short) %(objecttype) %(creatordate:iso)'
staging-2026-09-07 commit 2026-09-07 10:05:00 +0530
v0.9.0 tag 2026-09-07 10:21:00 +0530
v1.0.0 tag 2026-09-07 10:11:00 +0530
v1.0.0-verified tag 2026-09-07 10:22:00 +0530

# A tag can name any object. Here: one blob, the limits file as released, and then a tag of a tag.
$ git tag -a limits-schema-v1 -m "Limits file format, version 1" HEAD:config/limits.yaml
$ git cat-file -p limits-schema-v1 | head -3
object cb775a8efb9ad28e94389151972d6b06a5b263ee
type blob
tag limits-schema-v1
$ git tag -a v1.0.0-audited -m "Audit ticket SEC-88 closed" v1.0.0
hint: You have created a nested tag. The object referred to by your new tag is
hint: already a tag. If you meant to tag the object that it points to, use:
hint:
hint: 	git tag -f v1.0.0-audited v1.0.0^{}
hint: Disable this message with "git config set advice.nestedTag false"
$ git cat-file -p v1.0.0-audited | head -3
object b69624883fa40e51cbbf4c4baf49365ba1caa02e
type tag
tag v1.0.0-audited
$ git rev-parse v1.0.0-audited 'v1.0.0-audited^{tag}' 'v1.0.0-audited^{}'
6b410c8476aa6fcc8612bdcee3310b2654ae803d
6b410c8476aa6fcc8612bdcee3310b2654ae803d
eb112a5c44b0b2092c4ef2cae6e75b16da000f73

$ git tag "v1.0 final"
fatal: 'v1.0 final' is not a valid tag name.
[exit status: 128]
$ git tag v1.0.0
fatal: tag 'v1.0.0' already exists
[exit status: 128]
$ git check-ref-format refs/tags/v1.0.0+build.7
[exit status: 0]
$ git check-ref-format "refs/tags/v1.0.0~1"
[exit status: 1]

$ git log --oneline --decorate
a247d58 (HEAD -> main) Document streaming
c4f3ec7 (tag: v2.0.0-rc.2, tag: v2.0.0, tag: nightly) Fix stream flush
004673b (tag: v2.0.0-rc.1) Add streaming responses
e9fdbea (tag: v1.10.0) Add token check
ad88f54 (tag: v1.9.0) Add health endpoint
eb112a5 (tag: v1.2.0) Add rate limits
516c4c3 Add model router
37da450 Add README
$ git tag
nightly
v1.10.0
v1.2.0
v1.9.0
v2.0.0
v2.0.0-rc.1
v2.0.0-rc.2

$ git tag --sort=version:refname
nightly
v1.2.0
v1.9.0
v1.10.0
v2.0.0
v2.0.0-rc.1
v2.0.0-rc.2
$ git -c versionsort.suffix=-rc tag --sort=version:refname
nightly
v1.2.0
v1.9.0
v1.10.0
v2.0.0-rc.1
v2.0.0-rc.2
v2.0.0

$ git config set tag.sort version:refname
$ git config set versionsort.suffix -rc
$ git tag --list 'v2.*'
v2.0.0-rc.1
v2.0.0-rc.2
v2.0.0
$ git tag --list 'v[0-9]*' --sort=-version:refname | head -1
v2.0.0

$ git tag --contains HEAD~2
nightly
v2.0.0-rc.1
v2.0.0-rc.2
v2.0.0
$ git tag --no-contains HEAD~2
v1.2.0
v1.9.0
v1.10.0
$ git tag --points-at HEAD~1
nightly
v2.0.0-rc.2
v2.0.0
$ git tag --merged v1.9.0
v1.2.0
v1.9.0

$ git tag -a v1.0.0 -m "inference-gateway 1.0.0"
$ printf 'burst: 20\n' >> config/limits.yaml
$ git commit -q -am "Allow short bursts"
$ git push
To ../../server/inference-gateway.git
   d20ef7a..fa279e8  main -> main
$ git ls-remote --tags origin

$ git push origin v1.0.0
To ../../server/inference-gateway.git
 * [new tag]         v1.0.0 -> v1.0.0
$ git ls-remote --tags origin
3caaa3907d5f3c3071cdfebad5c416881fa9be07	refs/tags/v1.0.0
d20ef7a61e04035281b8b38ed0d78ee612252220	refs/tags/v1.0.0^{}

$ git tag -a v1.0.1 -m "inference-gateway 1.0.1"
$ git tag canary-ok
$ printf 'retry_after_seconds: 2\n' >> config/limits.yaml
$ git commit -q -am "Tell clients when to retry"
$ git tag wip-retry-header
$ git push --follow-tags
To ../../server/inference-gateway.git
   fa279e8..46cb046  main -> main
 * [new tag]         v1.0.1 -> v1.0.1
$ git ls-remote --tags origin
3caaa3907d5f3c3071cdfebad5c416881fa9be07	refs/tags/v1.0.0
d20ef7a61e04035281b8b38ed0d78ee612252220	refs/tags/v1.0.0^{}
65ad079e6bee92a0439fecf06a757ee24052b697	refs/tags/v1.0.1
fa279e82e36171f73f18c59df2c68bef182e5601	refs/tags/v1.0.1^{}

$ cd ../../asha/inference-gateway
$ git fetch
From ../../server/inference-gateway
   d20ef7a..46cb046  main       -> origin/main
 * [new tag]         v1.0.0     -> v1.0.0
 * [new tag]         v1.0.1     -> v1.0.1
$ git tag
v1.0.0
v1.0.1

$ cd ../../you/inference-gateway
$ git tag -d canary-ok
Deleted tag 'canary-ok' (was fa279e8)
$ git push origin --delete v1.0.1
To ../../server/inference-gateway.git
 - [deleted]         v1.0.1
$ git ls-remote --tags origin
3caaa3907d5f3c3071cdfebad5c416881fa9be07	refs/tags/v1.0.0
d20ef7a61e04035281b8b38ed0d78ee612252220	refs/tags/v1.0.0^{}
$ git tag
v1.0.0
v1.0.1
wip-retry-header

$ cd ../../asha/inference-gateway
$ git tag bisect-good-2026-09-07 HEAD~1
$ git fetch --prune
$ git tag
bisect-good-2026-09-07
v1.0.0
v1.0.1
$ git fetch --prune --prune-tags
From ../../server/inference-gateway
 - [deleted]         (none)     -> bisect-good-2026-09-07
 - [deleted]         (none)     -> v1.0.1
$ git tag
v1.0.0

# A bug is found an hour after the release. The fix lands on main, and the tag is "corrected".
$ printf 'requests_per_minute: 60\nmax_tokens: 4096\n' > config/limits.yaml
$ git commit -q -am "Fix max_tokens limit"
$ git push -q
$ git tag -f -a v1.2.0 -m "inference-gateway 1.2.0"
Updated tag 'v1.2.0' (was 5b231b5)
$ git push origin v1.2.0
To ../../server/inference-gateway.git
 ! [rejected]        v1.2.0 -> v1.2.0 (already exists)
error: failed to push some refs to '../../server/inference-gateway.git'
hint: Updates were rejected because the tag already exists in the remote.
[exit status: 1]
$ git push --force origin v1.2.0
To ../../server/inference-gateway.git
 + 5b231b5...5a0dc77 v1.2.0 -> v1.2.0 (forced update)

$ cd ../../asha/inference-gateway
$ git pull
From ../../server/inference-gateway
   d20ef7a..2518733  main       -> origin/main
Updating d20ef7a..2518733
Fast-forward
 config/limits.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
$ git log --oneline --decorate
2518733 (HEAD -> main, origin/main, origin/HEAD) Fix max_tokens limit
d20ef7a (tag: v1.2.0) Add rate limits
73c05d1 Add model router
dfbc830 Add README
$ git show v1.2.0:config/limits.yaml
requests_per_minute: 60
max_tokens: 2048

$ cd ../..
$ git clone -q server/inference-gateway.git ci/inference-gateway
$ cd ci/inference-gateway
$ git log --oneline --decorate
2518733 (HEAD -> main, tag: v1.2.0, origin/main, origin/HEAD) Fix max_tokens limit
d20ef7a Add rate limits
73c05d1 Add model router
dfbc830 Add README
$ git show v1.2.0:config/limits.yaml
requests_per_minute: 60
max_tokens: 4096

  server                      Asha's clone                 CI clone (cloned after the move)
  v1.2.0 -> 2518733 (moved)   v1.2.0 -> d20ef7a (kept)     v1.2.0 -> 2518733

  d20ef7a  Add rate limits       <- what was released as 1.2.0
  2518733  Fix max_tokens limit  <- what the server now calls 1.2.0

$ cd ../../asha/inference-gateway
# What the server says the tag is, and what this clone says it is:
$ git ls-remote origin 'refs/tags/v1.2.0^{}'
2518733b711886bd82418641eb2434765079e288	refs/tags/v1.2.0^{}
$ git rev-parse 'v1.2.0^{commit}'
d20ef7a61e04035281b8b38ed0d78ee612252220
$ git fetch --tags
From ../../server/inference-gateway
 ! [rejected] v1.2.0     -> v1.2.0  (would clobber existing tag)
[exit status: 1]

Observed behavior : two builds labelled v1.2.0 contain different code.
Git state         : refs/tags/v1.2.0 names d20ef7a in clones that fetched before the move and
                    2518733 on the server and in clones made after it.
Mechanism         : fetch creates missing tags and refuses to overwrite existing ones ("would
                    clobber existing tag"); a plain fetch does not even report the difference.
Root cause        : a published tag was replaced with git tag -f and git push --force.
Why Git does this : a tag name is a promise about content. The manual: Git "does not (and it
                    should not) change tags behind users back".
Correct fix       : put the tag back where it was published; release the new content under a new name.
Prevention        : server-side rule that existing release tags cannot be updated or deleted;
                    deploy by commit ID or image digest, not by tag name alone.

# The sane repair: put v1.2.0 back where it was published, and release the fix as v1.2.1.
# Asha still has the original tag object, so she can restore it.
$ git push --force origin v1.2.0
To ../../server/inference-gateway.git
 + 5a0dc77...5b231b5 v1.2.0 -> v1.2.0 (forced update)
$ cd ../../you/inference-gateway
$ git fetch --tags --force
From ../../server/inference-gateway
 t [tag update]      v1.2.0     -> v1.2.0
$ git tag -a v1.2.1 -m "inference-gateway 1.2.1: fix max_tokens limit"
$ git push origin v1.2.1
To ../../server/inference-gateway.git
 * [new tag]         v1.2.1 -> v1.2.1
$ git log --oneline --decorate
2518733 (HEAD -> main, tag: v1.2.1, origin/main, origin/HEAD) Fix max_tokens limit
d20ef7a (tag: v1.2.0) Add rate limits
73c05d1 Add model router
dfbc830 Add README

# Two server settings that sound as if they protect tags. Set them and try.
$ cd ../../you/inference-gateway
$ git -C ../../server/inference-gateway.git config set receive.denyNonFastForwards true
$ git -C ../../server/inference-gateway.git config set receive.denyDeletes true
$ git tag -a v1.3.0-rc.1 -m "Release candidate"
$ git push -q origin v1.3.0-rc.1
$ git tag -f -a v1.3.0-rc.1 -m "Release candidate, moved" HEAD~1
Updated tag 'v1.3.0-rc.1' (was d15e77e)
$ git push --force origin v1.3.0-rc.1
To ../../server/inference-gateway.git
 + d15e77e...cc3836f v1.3.0-rc.1 -> v1.3.0-rc.1 (forced update)
[exit status: 0]
$ git push origin --delete v1.3.0-rc.1
To ../../server/inference-gateway.git
 - [deleted]         v1.3.0-rc.1
[exit status: 0]

# A server-side update hook: an existing tag under refs/tags/v* can be neither moved nor deleted.
$ cat ../../update-hook
#!/bin/sh
# update hook: called once per ref with <ref> <old-id> <new-id>.
# A release tag may be created. It may not be moved or deleted.
ref=$1 old=$2
case "$ref" in
refs/tags/v*)
  if ! printf '%s' "$old" | grep -q '^0*$'; then
    echo "policy: $ref is published and immutable; release a new version" >&2
    exit 1
  fi ;;
esac
exit 0
$ cp ../../update-hook ../../server/inference-gateway.git/hooks/update
$ chmod +x ../../server/inference-gateway.git/hooks/update
$ git push -q origin v1.3.0-rc.1
$ git tag -f -a v1.3.0-rc.1 -m "Release candidate, moved again" HEAD
Updated tag 'v1.3.0-rc.1' (was cc3836f)
$ git push --force origin v1.3.0-rc.1
remote: policy: refs/tags/v1.3.0-rc.1 is published and immutable; release a new version        
remote: error: hook declined to update refs/tags/v1.3.0-rc.1        
To ../../server/inference-gateway.git
 ! [remote rejected] v1.3.0-rc.1 -> v1.3.0-rc.1 (hook declined)
error: failed to push some refs to '../../server/inference-gateway.git'
[exit status: 1]
$ git push origin --delete v1.3.0-rc.1
remote: policy: refs/tags/v1.3.0-rc.1 is published and immutable; release a new version        
remote: error: hook declined to update refs/tags/v1.3.0-rc.1        
To ../../server/inference-gateway.git
 ! [remote rejected] v1.3.0-rc.1 (hook declined)
error: failed to push some refs to '../../server/inference-gateway.git'
[exit status: 1]

$ git log --oneline --decorate
c053f0d (HEAD -> main) Add token check
f37f723 Add health endpoint
eb112a5 (tag: v1.0.0, tag: staging-ok) Add rate limits
516c4c3 Add model router
37da450 Add README
$ git describe
v1.0.0-2-gc053f0d
$ git rev-parse --short HEAD
c053f0d
$ git rev-list --count v1.0.0..HEAD
2
$ git log --oneline "$(git describe)" -1
c053f0d Add token check

$ printf 'def check(token):\n    return token == "letmein"\n' > gateway/auth.py
$ git describe --dirty
v1.0.0-2-gc053f0d-dirty
$ git describe --dirty=+local
v1.0.0-2-gc053f0d+local
$ git restore gateway/auth.py
$ git describe --dirty
v1.0.0-2-gc053f0d

$ git tag -a v1.1.0-rc.1 -m "Release candidate" HEAD~1
$ git tag deployed-staging
$ git describe
v1.1.0-rc.1-1-gc053f0d
$ git describe --exclude '*-rc.*'
v1.0.0-2-gc053f0d
$ git describe --tags
deployed-staging
$ git describe --tags --match 'v[0-9]*'
v1.1.0-rc.1-1-gc053f0d

$ git describe
fatal: No names found, cannot describe anything.
[exit status: 128]
$ git describe --always
eb112a5
$ git tag staging-ok
$ git describe
fatal: No annotated tags can describe 'eb112a5c44b0b2092c4ef2cae6e75b16da000f73'.
However, there were unannotated tags: try --tags.
[exit status: 128]
$ git describe --tags
staging-ok

$ cd ../..
$ git clone -q --depth 1 "file://$PWD/server/inference-gateway.git" ci/inference-gateway
$ cd ci/inference-gateway
$ git rev-parse --is-shallow-repository
true
$ git log --oneline
72212ba Add token check
$ git tag
$ git describe
fatal: No names found, cannot describe anything.
[exit status: 128]
$ git describe --always
72212ba

$ git fetch -q --depth 1 origin tag v1.0.0
$ git tag
v1.0.0
$ git describe
fatal: No tags can describe '72212bae7bd9bd85bd7300a9a92d9f8d50f89807'.
Try --always, or create some tags.
[exit status: 128]

$ git fetch --unshallow
$ git rev-parse --is-shallow-repository
false
$ git describe
v1.0.0-2-g72212ba

Observed behavior : the build in CI gets a fallback version or fails; locally the version is v1.0.0-2-g72212ba.
Git state         : the CI checkout is shallow (one commit) and has no refs/tags/.
Mechanism         : git describe needs a tagged ancestor and the commits between it and HEAD.
Root cause        : the checkout step fetched one commit; tools that derive versions from tags
                    (git describe, setuptools-scm and similar) fall back or fail.
Why Git does this : a shallow clone is a deliberate trade of history for speed.
Correct fix       : fetch full history and tags in jobs that compute a version.
Prevention        : make the release job fail when git describe --exact-match fails.

$ git cherry-pick -x main~1
[release/1.2 c40960e] Fix max_tokens limit
 Date: Mon Sep 7 10:08:00 2026 +0530
 1 file changed, 1 insertion(+), 1 deletion(-)
$ git log -1 --format=%B
Fix max_tokens limit

(cherry picked from commit 362b3592d29ea9c07389c0782fd46c24269b6a3f)

$ git tag -a v1.2.1 -m "inference-gateway 1.2.1: fix max_tokens limit"

$ git log --graph --oneline --decorate --all
* c40960e (HEAD -> release/1.2, tag: v1.2.1) Fix max_tokens limit
| * 8ed5c59 (main) Add batch endpoint
| * 362b359 Fix max_tokens limit
| * 27d1fb6 Add streaming responses
|/  
* eb112a5 (tag: v1.2.0) Add rate limits
* 516c4c3 Add model router
* 37da450 Add README
$ git describe release/1.2
v1.2.1
$ git describe main
v1.2.0-3-g8ed5c59

$ git tag --contains main~1
$ git tag --contains release/1.2
v1.2.1
$ git tag --merged main
v1.2.0
$ git cherry -v release/1.2 main
+ 27d1fb6a67cdb41e87d5771c3e10310823ee0dcb Add streaming responses
- 362b3592d29ea9c07389c0782fd46c24269b6a3f Fix max_tokens limit
+ 8ed5c59df2f47f80f396b5ba11769efbe1d6491e Add batch endpoint

$ git switch -q main
$ git tag -a v1.3.0 -m "inference-gateway 1.3.0"
$ git tag --sort=version:refname
v1.2.0
v1.2.1
v1.3.0
$ git describe main
v1.3.0
$ git log --oneline v1.2.1..v1.3.0
8ed5c59 Add batch endpoint
362b359 Fix max_tokens limit
27d1fb6 Add streaming responses
$ git log --oneline --cherry-pick --right-only v1.2.1...v1.3.0
8ed5c59 Add batch endpoint
27d1fb6 Add streaming responses

$ git -c gpg.program=~/lab-bin/show-args commit -S --allow-empty -m "Signed with OpenPGP"
error: gpg failed to sign the data:
signing program called with: --status-fd=2 -bsau Lab User <you@example.com>

fatal: failed to write commit object
[exit status: 128]

$ git -c gpg.format=ssh -c gpg.ssh.program=~/lab-bin/show-args commit -S --allow-empty -m "Signed with SSH"
fatal: either user.signingkey or gpg.ssh.defaultKeyCommand needs to be configured
[exit status: 128]
$ git -c gpg.format=ssh -c gpg.ssh.program=~/lab-bin/show-args -c user.signingKey=~/keys/signing_key.pub commit -S --allow-empty -m "Signed with SSH"
error: signing program called with: -Y sign -n git -f $LAB/ch14b/signing-backends/home/keys/signing_key.pub <file with the payload>

fatal: failed to write commit object
[exit status: 128]

$ mkdir ~/keys
$ ssh-keygen -q -t ed25519 -N '' -C 'you@example.com signing key 2026' -f ~/keys/signing_key
$ ls ~/keys
signing_key
signing_key.pub
$ cat ~/keys/signing_key.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPeZ8qdHWOUuKtL/yAKkDk4n+e6oo2sO2JTJ8lmdYFDE you@example.com signing key 2026
$ ssh-keygen -l -f ~/keys/signing_key.pub
256 SHA256:wIC1YB2G8ErM9XCgJQ+pItmnhwF/fv4lGfAmWeriHGs you@example.com signing key 2026 (ED25519)

$ git config set --global gpg.format ssh
$ git config set --global user.signingKey ~/keys/signing_key.pub
$ git config get --all --show-names --regexp "^(gpg|user\.signingkey)"
user.signingkey $LAB/ch14b/ssh-signing/home/keys/signing_key.pub
gpg.format ssh

$ printf 'burst: 20\n' >> config/limits.yaml
$ git commit -q -S -am "Allow short bursts"
$ git cat-file -p HEAD
tree c84890b7f7cbb711c04b9a7fb78410beb5897d9b
parent eb112a5c44b0b2092c4ef2cae6e75b16da000f73
author Lab User <you@example.com> 1788756300 +0530
committer Lab User <you@example.com> 1788756300 +0530
gpgsig -----BEGIN SSH SIGNATURE-----
 U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAg95nyp0dY5S4q0v/IAqQOTif57q
 ijaw7YlMnyWZ1gUMQAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
 AAAAQJMccrn4Dmj2cHUPAHhz39NlMtXXlS2u+/lOewunSjVhvREL3WkYdp/G0PrihonpvT
 +ZHT0fNnmCm7pVB7KlHQ4=
 -----END SSH SIGNATURE-----

Allow short bursts

$ git verify-commit HEAD
error: gpg.ssh.allowedSignersFile needs to be configured and exist for ssh signature verification
[exit status: 1]
$ git log -1 --show-signature --format="%h %s"
error: gpg.ssh.allowedSignersFile needs to be configured and exist for ssh signature verification
No signature
f215ce4 Allow short bursts
$ git log -1 --format='%h  %G?  %s'
error: gpg.ssh.allowedSignersFile needs to be configured and exist for ssh signature verification
f215ce4  N  Allow short bursts

Observed behavior : git log --show-signature prints "No signature", and %G? prints N, for a
                    commit that visibly has a gpgsig header.
Git state         : the commit is signed. gpg.ssh.allowedSignersFile is not set.
Mechanism         : SSH verification means "find this key in my list of allowed signers".
                    Without a list Git does not start ssh-keygen at all and reports no result.
Root cause        : signing needs one key; verifying needs a statement of whom you trust.
Why Git does this : an SSH key has no owner written into it and no web of trust. The manual:
                    trust is "fully" when the key is in the file and "undefined" otherwise.
Correct fix       : create the allowed-signers file and point gpg.ssh.allowedSignersFile at it.
Prevention        : distribute the file with the signing setup; a team can keep it in the repository.

$ printf 'you@example.com namespaces="git" %s\n' "$(cut -d' ' -f1,2 ~/keys/signing_key.pub)" > ~/allowed_signers
$ cat ~/allowed_signers
you@example.com namespaces="git" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPeZ8qdHWOUuKtL/yAKkDk4n+e6oo2sO2JTJ8lmdYFDE
$ git config set --global gpg.ssh.allowedSignersFile ~/allowed_signers
$ git verify-commit HEAD
Good "git" signature for you@example.com with ED25519 key SHA256:wIC1YB2G8ErM9XCgJQ+pItmnhwF/fv4lGfAmWeriHGs
[exit status: 0]
$ git log -2 --show-signature --format="%h %an: %s"
Good "git" signature for you@example.com with ED25519 key SHA256:wIC1YB2G8ErM9XCgJQ+pItmnhwF/fv4lGfAmWeriHGs
f215ce4 Lab User: Allow short bursts
eb112a5 Lab User: Add rate limits

$ git log -2 --format='%h  %G?  signer=%GS  trust=%GT  %s'
f215ce4  G  signer=you@example.com  trust=fully  Allow short bursts
eb112a5  N  signer=  trust=undefined  Add rate limits
$ git log -1 --format='%GK'
SHA256:wIC1YB2G8ErM9XCgJQ+pItmnhwF/fv4lGfAmWeriHGs

$ git config set --global commit.gpgSign true
$ git config set --global tag.gpgSign true
$ printf 'retry_after_seconds: 2\n' >> config/limits.yaml
$ git commit -q -am "Tell clients when to retry"
$ git commit -q --no-gpg-sign --allow-empty -m "Trigger the nightly evaluation"
$ git log -4 --format='%h  %G?  %GS  %s'
e32a07f  N    Trigger the nightly evaluation
9d47104  G  you@example.com  Tell clients when to retry
f215ce4  G  you@example.com  Allow short bursts
eb112a5  N    Add rate limits

$ git tag -m "inference-gateway 1.0.0" v1.0.0 HEAD~1
$ git cat-file -p v1.0.0
object 9d471046051e8d578b339ee37eb466c71e16b6ec
type commit
tag v1.0.0
tagger Lab User <you@example.com> 1788757380 +0530

inference-gateway 1.0.0
-----BEGIN SSH SIGNATURE-----
U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAg95nyp0dY5S4q0v/IAqQOTif57q
ijaw7YlMnyWZ1gUMQAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
AAAAQENhU0YSEgUB1RmZBsnzJdHgXZdddaBvXKoPIFK23QLUTUltL6Gr+o9kyWszNlomBF
apz4b7Ok5FFB+R/+c0swo=
-----END SSH SIGNATURE-----
$ git verify-tag v1.0.0
Good "git" signature for you@example.com with ED25519 key SHA256:wIC1YB2G8ErM9XCgJQ+pItmnhwF/fv4lGfAmWeriHGs
[exit status: 0]
$ git tag -v v1.0.0
Good "git" signature for you@example.com with ED25519 key SHA256:wIC1YB2G8ErM9XCgJQ+pItmnhwF/fv4lGfAmWeriHGs
object 9d471046051e8d578b339ee37eb466c71e16b6ec
type commit
tag v1.0.0
tagger Lab User <you@example.com> 1788757380 +0530

inference-gateway 1.0.0

# Git does no cryptography itself. The programs it starts to sign and to verify:
$ GIT_TRACE=1 git commit -q --allow-empty -m 'Re-run the nightly evaluation' 2>&1 | grep -o 'run_command: ssh-keygen -Y [a-z-]* -n git'
run_command: ssh-keygen -Y sign -n git
$ GIT_TRACE=1 git verify-commit HEAD 2>&1 | grep -o 'run_command: ssh-keygen -Y [a-z-]*'
run_command: ssh-keygen -Y find-principals
run_command: ssh-keygen -Y verify
$ git verify-commit --raw HEAD
Good "git" signature for you@example.com with ED25519 key SHA256:wIC1YB2G8ErM9XCgJQ+pItmnhwF/fv4lGfAmWeriHGs

$ git log -1 --format='%h  %G?  %GS  %s'
b389204  G  you@example.com  Allow short bursts
# Write a second commit object: same headers, same signature, one word of the message changed.
$ git cat-file commit HEAD | sed 's/short bursts/unlimited bursts/' | git hash-object -t commit -w --stdin > ../forged-id
$ git cat-file -p "$(cat ../forged-id)" | tail -1
Allow unlimited bursts
$ git verify-commit "$(cat ../forged-id)"
Could not verify signature.
Signature verification failed: incorrect signature
[exit status: 1]
$ git log -1 --format='%G?  %s' "$(cat ../forged-id)"
B  Allow unlimited bursts

# The signature is inside the object. Which refs point at the object is not part of it.
$ git branch hotfix/anything HEAD
$ git log -1 --format='%G?  %D' hotfix/anything
G  HEAD -> main, tag: v1.0.0, hotfix/anything
$ git update-ref refs/tags/v9.9.9 "$(git rev-parse v1.0.0)"
$ git verify-tag v9.9.9
Good "git" signature for you@example.com with ED25519 key SHA256:IBY0fLOBtdFj0fbHvPhR5Di74E0PfNUAA+UYVYfgHgw
[exit status: 0]
$ git cat-file -p v9.9.9 | sed -n 1,3p
object b3892048e77c43a09f64eedfeccc408eeb532e3a
type commit
tag v1.0.0
$ git tag -d v9.9.9
Deleted tag 'v9.9.9' (was 849e258)

$ git commit -q --allow-empty -m "Trigger the nightly evaluation"
$ git log -2 --format='%h  %G?  %s'
65bce98  G  Trigger the nightly evaluation
b389204  G  Allow short bursts
$ git commit -q --amend --allow-empty --no-gpg-sign -m "Trigger the nightly evaluation run"
$ git log -2 --format='%h  %G?  %s'
2bc6aa4  N  Trigger the nightly evaluation run
b389204  G  Allow short bursts
$ git rebase -q --no-gpg-sign --force-rebase HEAD~2
$ git log -2 --format='%h  %G?  %s'
93c3833  N  Trigger the nightly evaluation run
14656b3  N  Allow short bursts
$ git rebase -q --gpg-sign --force-rebase HEAD~2
$ git log -2 --format='%h  %G?  %s'
7129bbb  G  Trigger the nightly evaluation run
acc22ee  G  Allow short bursts

$ git -c user.signingKey=~/keys/stranger.pub commit -q --allow-empty -m "Bump the model default"
$ git verify-commit HEAD
Good "git" signature with ED25519 key SHA256:dvbzrGKgxrd5uBx6kt8ux+C+H3qGogE5fD3p/a8CHZA
No principal matched.
[exit status: 1]
$ git log -1 --format='%h  %G?  signer=%GS  trust=%GT  %s'
81b4414  U  signer=  trust=undefined  Bump the model default

# The lab clock says 7 September 2026. Give the key a validity window that ended on 31 August.
$ printf 'you@example.com namespaces="git",valid-before="20260831" %s\n' "$(cut -d' ' -f1,2 ~/keys/you_2026.pub)" > ~/allowed_signers
$ git verify-commit HEAD~1
Good "git" signature with ED25519 key SHA256:IBY0fLOBtdFj0fbHvPhR5Di74E0PfNUAA+UYVYfgHgw
$LAB/ch14b/signature-scope/home/allowed_signers:1: key has expired: verify time 2026-09-07T10:30:00 > valid-before 2026-08-31T00:00:00

No principal matched.
[exit status: 1]
# The verify time is the committer date, and the committer date is whatever the committer says.
$ GIT_COMMITTER_DATE='2026-08-30T12:00:00+05:30' git commit -q --allow-empty -m 'Rotate the staging credentials'
$ git verify-commit HEAD
Good "git" signature for you@example.com with ED25519 key SHA256:IBY0fLOBtdFj0fbHvPhR5Di74E0PfNUAA+UYVYfgHgw
[exit status: 0]
$ git log -1 --format='%h  %G?  committed %cs  %s'
8c7d0a6  G  committed 2026-08-30  Rotate the staging credentials

$ cut -d' ' -f1,2 ~/keys/you_2026.pub > ~/revoked_keys
$ git config set --global gpg.ssh.revocationFile ~/revoked_keys
$ git verify-commit HEAD
Could not verify signature.
[exit status: 1]
$ git log -1 --format='%h  %G?  %s'
8c7d0a6  B  Rotate the staging credentials

   signed bytes (the commit without gpgsig)             not signed
   +--------------------------------------------+      +---------------------------------+
   | tree      -> every file, by hash           |      | refs: which branch or tag name  |
   | parent(s) -> all earlier history, by hash  |      | which repository, which fork    |
   | author    name <email> date                |      | who pushed it, and when         |
   | committer name <email> date                |      | reviews, CI results, approvals  |
   | message                                    |      | whether the author line is true |
   +--------------------------------------------+      +---------------------------------+
        |  ssh-keygen -Y sign -n git
        v
   gpgsig header (commit)  or  block after the message (tag)

$ printf 'requests_per_minute: 6000\n' > config/limits.yaml
$ git commit -q -am "Raise the rate limit" --author="Asha Rao <asha@example.com>"
$ git log -1 --format='%h  author=%an <%ae>  committer=%cn <%ce>  %s'
fee79f6  author=Asha Rao <asha@example.com>  committer=Lab User <you@example.com>  Raise the rate limit

$ printf 'requests_per_minute: 60000\n' > config/limits.yaml
$ git -c user.name="Asha Rao" -c user.email=asha@example.com commit -q -am "Raise the rate limit again"
$ git log -3 --format='%h  author=%an <%ae>  committer=%cn <%ce>  %s'
6e10a38  author=Asha Rao <asha@example.com>  committer=Asha Rao <asha@example.com>  Raise the rate limit again
fee79f6  author=Asha Rao <asha@example.com>  committer=Lab User <you@example.com>  Raise the rate limit
39f0449  author=Asha Rao <asha@example.com>  committer=Asha Rao <asha@example.com>  Add health endpoint

# Her real commit and your forgery, header by header (tree, parent and dates differ, as for any two commits):
$ git cat-file -p HEAD~2 | sed -n "/^author/,/^committer/p"
author Asha Rao <asha@example.com> 1788756000 +0530
committer Asha Rao <asha@example.com> 1788756000 +0530
$ git cat-file -p HEAD | sed -n "/^author/,/^committer/p"
author Asha Rao <asha@example.com> 1788756480 +0530
committer Asha Rao <asha@example.com> 1788756480 +0530

$ git push
To ../../server/inference-gateway.git
   39f0449..6e10a38  main -> main
$ git -C ../../server/inference-gateway.git log -3 --format='%h  %an <%ae>  %s'
6e10a38  Asha Rao <asha@example.com>  Raise the rate limit again
fee79f6  Asha Rao <asha@example.com>  Raise the rate limit
39f0449  Asha Rao <asha@example.com>  Add health endpoint
$ git shortlog -sne HEAD
     3	Asha Rao <asha@example.com>
     3	Lab User <you@example.com>

# You cannot sign as Asha: you do not have her private key. You can sign with your own.
$ printf 'requests_per_minute: 60000\n' > config/limits.yaml
$ git -c user.name="Asha Rao" -c user.email=asha@example.com commit -q -S -am "Raise the rate limit again"
$ git verify-commit HEAD
Good "git" signature for you@example.com with ED25519 key SHA256:XpH8NGlAagHBiC1XlKWmz7zMcGZ2uC4HE68dHGQP3zg
[exit status: 0]
$ git log -3 --format='%h  %G?  author=%ae  signer=%GS  %s'
4687f7f  G  author=asha@example.com  signer=you@example.com  Raise the rate limit again
bc6a046  N  author=asha@example.com  signer=  Raise the rate limit
4306257  G  author=asha@example.com  signer=asha@example.com  Add health endpoint

# Git verified a signature. It did not compare the signer with the author. A policy check does:
$ git log -3 --format='%h %G? %ae %GS' | awk '{ ok = ($2 == "G" && $3 == $4) ? "ok  " : "FAIL"; print ok, $0 }'
FAIL 4687f7f G asha@example.com you@example.com
FAIL bc6a046 N asha@example.com 
ok   4306257 G asha@example.com asha@example.com

$ git switch -q -c integration main~2
$ git merge --verify-signatures --ff-only main~1
fatal: Commit bc6a046 does not have a GPG signature.
[exit status: 128]
# The option looks at one commit only: the tip of what is being merged.
$ git merge --verify-signatures --ff-only main
Commit 4687f7f has a good GPG signature by you@example.com
Updating 4306257..4687f7f
Fast-forward
 config/limits.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
[exit status: 0]
$ git log -3 --format='%h  %G?  author=%ae  signer=%GS'
4687f7f  G  author=asha@example.com  signer=you@example.com
bc6a046  N  author=asha@example.com  signer=
4306257  G  author=asha@example.com  signer=asha@example.com