commit 8d4a8ca19cca1354c4d99d5df888c3c9b56e075c
from: Josh Rickmar <jrick@zettaport.com>
date: Fri Sep 02 14:02:55 2022 UTC

Do not segfault verifying "lightweight" tags

ok stsp@

commit - 4a962942057bae9fbd47916e75d554fb52e0ec37
commit + 8d4a8ca19cca1354c4d99d5df888c3c9b56e075c
blob - 24a866da4c5f2667eabcecfe5a0b19cde5a70e76
blob + 64ef5fc0ef4b1bd3dce557f8ecb20c5f2946dee6
--- got/got.c
+++ got/got.c
@@ -7043,7 +7043,7 @@ list_tags(struct got_repository *repo, const char *tag
 				break;
 		}
 
-		if (verify_tags) {
+		if (tag && verify_tags) {
 			ssh_sig = got_sigs_get_tagmsg_ssh_signature(
 			    got_object_tag_get_message(tag));
 			if (ssh_sig && allowed_signers == NULL) {
blob - bff93134d3aa7848b5554c7e85bc8e677b51c82d
blob + 20ccfdcdf9a3a29fed86ad247da1be233bf3945a
--- regress/cmdline/tag.sh
+++ regress/cmdline/tag.sh
@@ -244,6 +244,9 @@ test_tag_list_lightweight() {
 
 	got tag -r $testroot/repo -l > $testroot/stdout
 
+	# test signature validation ignoring lightweight tags
+	got tag -r $testroot/repo -V > $testroot/stdout
+
 	echo "-----------------------------------------------" \
 		> $testroot/stdout.expected
 	echo "tag $tag2 $tag_id2" >> $testroot/stdout.expected