just a nit I noticed while looking for something else; there's no need
to copy the signer id, we can just keep optarg or the values returned
by got_gotconfig_get_signer_id.

diff /home/op/w/got.tags
commit - 87332a0e6e71182f1fb148d7f42e78105713285b
path + /home/op/w/got.tags
blob - 87ce79c90db5ebd79d068d2738dfb439ab4da56a
file + got/got.c
--- got/got.c
+++ got/got.c
@@ -709,15 +709,12 @@ static const struct got_error *
 	return NULL;
 }
 
-static const struct got_error *
-get_signer_id(char **signer_id, struct got_repository *repo,
-    struct got_worktree *worktree)
+static const char *
+get_signer_id(struct got_repository *repo, struct got_worktree *worktree)
 {
 	const char *got_signer_id = NULL;
 	const struct got_gotconfig *worktree_conf = NULL, *repo_conf = NULL;
 
-	*signer_id = NULL;
-
 	if (worktree)
 		worktree_conf = got_worktree_get_gotconfig(worktree);
 	repo_conf = got_repo_get_gotconfig(repo);
@@ -734,12 +731,7 @@ get_signer_id(char **signer_id, struct got_repository 
 	if (got_signer_id == NULL)
 		got_signer_id = got_gotconfig_get_signer_id(repo_conf);
 
-	if (got_signer_id) {
-		*signer_id = strdup(got_signer_id);
-		if (*signer_id == NULL)
-			return got_error_from_errno("strdup");
-	}
-	return NULL;
+	return got_signer_id;
 }
 
 static const struct got_error *
@@ -7505,7 +7497,7 @@ cmd_tag(int argc, char *argv[])
 	char *cwd = NULL, *repo_path = NULL, *commit_id_str = NULL;
 	char *gitconfig_path = NULL, *tagger = NULL;
 	char *allowed_signers = NULL, *revoked_signers = NULL;
-	char *signer_id = NULL;
+	const char *signer_id = NULL;
 	const char *tag_name = NULL, *commit_id_arg = NULL, *tagmsg = NULL;
 	int ch, do_list = 0, verify_tags = 0, verbosity = 0;
 	int *pack_fds = NULL;
@@ -7531,11 +7523,7 @@ cmd_tag(int argc, char *argv[])
 			got_path_strip_trailing_slashes(repo_path);
 			break;
 		case 's':
-			signer_id = strdup(optarg);
-			if (signer_id == NULL) {
-				error = got_error_from_errno("strdup");
-				goto done;
-			}
+			signer_id = optarg;
 			break;
 		case 'V':
 			verify_tags = 1;
@@ -7662,11 +7650,8 @@ cmd_tag(int argc, char *argv[])
 		error = get_author(&tagger, repo, worktree);
 		if (error)
 			goto done;
-		if (signer_id == NULL) {
-			error = get_signer_id(&signer_id, repo, worktree);
-			if (error)
-				goto done;
-		}
+		if (signer_id == NULL)
+			signer_id = get_signer_id(repo, worktree);
 
 		if (tagmsg) {
 			if (signer_id) {
@@ -7728,7 +7713,6 @@ done:
 	free(tagger);
 	free(allowed_signers);
 	free(revoked_signers);
-	free(signer_id);
 	return error;
 }