1# What attestations, site deploys and releases publish about who made them:2# the forge name the signing key has in allowed_signers (or forge.user) and3# a made-up machine name kept in the global git config (or forge.machine);4# never the hostname or the local account. Pages show neither, only who5# signed.6. "$(dirname "$0")/../lib.sh"7user dami8repo dami/greet9clone dami dami/greet "$T/w/d"10mkdir -p "$T/w/d/.forge"11printf '#!/bin/sh\ntrue\n' >"$T/w/d/.forge/ci"12chmod +x "$T/w/d/.forge/ci"13at "$T/w/d" commit "first"14export FORGE_USER=dami15host=$(hostname -s 2>/dev/null || hostname)16me=$(id -un)17runner() { git -C "$T/w/d" notes --ref=ci show "$1" | sed -n 's/^runner //p' | tail -n 1; }1819ok at "$T/w/d" "$FORGE" attest20r=$(runner HEAD)21case $r in dami@[a-z]*-[a-z]*-[0-9a-f][0-9a-f]) ;; *) fail "runner is '$r'" ;; esac22case $r in *"$host"* | "$me"@*) [ "$me" = dami ] || fail "runner '$r' names the host or the account" ;; esac23m=$(git config --global --get forge.machine)24eq "dami@$m" "$r"25# The same name next time.26at "$T/w/d" commit "second"27ok at "$T/w/d" "$FORGE" attest28eq "$(runner HEAD)" "$r"29# forge.user and forge.machine win.30at "$T/w/d" git config forge.user someone31at "$T/w/d" git config forge.machine lab-box32at "$T/w/d" commit "third"33ok at "$T/w/d" "$FORGE" attest34eq "$(runner HEAD)" someone@lab-box35at "$T/w/d" git config --unset forge.user36at "$T/w/d" git config --unset forge.machine3738# A release names its builder the same way.39at "$T/w/d" git tag v140mkdir "$T/f" && printf 'x\n' >"$T/f/tool"41ok push_as dami "$T/w/d" origin main refs/notes/ci42ok at "$T/w/d" "$FORGE" release publish v1 "$T/f/tool"43eq "$(git --git-dir="$FORGE_ROOT/dami/greet.git" log -1 --format='%(trailers:key=Built-By,valueonly)' refs/releases/v1 | tr -d '\n')" "$r"4445# Pages show who signed, not the runner or the builder.46build dami/greet47lacks "$FORGE_WWW/dami/greet/commit/$(git -C "$T/w/d" rev-parse HEAD~1)/index.html" "$m"48has "$FORGE_WWW/dami/greet/commit/$(git -C "$T/w/d" rev-parse HEAD~1)/index.html" 'signed by dami'49lacks "$FORGE_WWW/dami/greet/releases/index.html" "$m"