git authenticate: Gracefully handle passing an annotated tag to ‘--end’.

Partly fixes <https://issues.guix.gnu.org/74583>.

Previously, passing an annotated tag to ‘--end’, as can happen when
‘guix git authenticate’ is invoked by the pre-push hook when pushing
tags, would lead to an error:

  guix git: error: Git error: the requested type does not match the type in the ODB

* guix/scripts/git/authenticate.scm (ensure-commit-id): New procedure.
(guix-git-authenticate): Use it.
* tests/guix-git-authenticate.sh: Test with $v1_2_0_annotated_tag.

Change-Id: I22e8eb665609522c80c1f0dcb9e77a46c23c0c3c

guix/scripts/git/authenticate.scm

@@ -233,6 +233,14 @@ known-broken version is installed."
         (display %pre-push-hook port)
         (chmod port #o755)))))
 
+(define (ensure-commit-id repository oid)
+  "If OID refers to an annotated tag, return its target commit; otherwise
+return OID."
+  (let ((obj (object-lookup repository oid)))
+    (if (= OBJ-TAG (object-type obj))
+        (tag-target-id (tag-lookup repository oid))
+        oid)))
+
 (define (show-stats stats)
   "Display STATS, an alist containing commit signing stats as returned by
 'authenticate-repository'."
@@ -337,7 +345,7 @@ expected COMMIT and SIGNER~%")))
             (end         (match (assoc-ref options 'end-commit)
                            (#f  (reference-target
                                  (repository-head repository)))
-                           (oid oid)))
+                           (oid (ensure-commit-id repository oid))))
             (history     (match (assoc-ref options 'historical-authorizations)
                            (#f '())
                            (file (call-with-input-file file

tests/guix-git-authenticate.sh

@@ -1,5 +1,5 @@
 # GNU Guix --- Functional package management for GNU
-# Copyright © 2020, 2022, 2024 Ludovic Courtès <ludo@gnu.org>
+# Copyright © 2020, 2022, 2024-2025 Ludovic Courtès <ludo@gnu.org>
 #
 # This file is part of GNU Guix.
 #
@@ -53,6 +53,13 @@ guix git authenticate				\
      --cache-key="$cache_key" --stats		\
      --end="$v1_2_0_commit"
 
+# Likewise, but pass the OID of the annotated tag 'v1.2.0' instead of that of
+# the commit--this mimics what the pre-push hook gets when pushing tags.
+v1_2_0_annotated_tag="d5b556eef57321d0be89fdb07db447b2db2718ed"
+guix git authenticate				\
+     --cache-key="$cache_key" --stats		\
+     --end="$v1_2_0_annotated_tag"
+
 rm "$XDG_CACHE_HOME/guix/authentication/$cache_key"
 
 # Commit and signer of the 'v1.0.0' tag.