1# Only the owner and collaborators push refs/releases/*, like tags: anyone2# else's release is refused, however well it is signed, and so is deleting one.3. "$(dirname "$0")/../lib.sh"4user dami5user ana6repo dami/greet7clone dami dami/greet "$T/w/d"8at "$T/w/d" commit "first"9ok push_as dami "$T/w/d" origin main10at "$T/w/d" git tag v111ok push_as dami "$T/w/d" origin v112clone ana dami/greet "$T/w/a"13mkdir "$T/f"14printf 'greet\n' >"$T/f/greet"15c=$(release_commit "$T/w/a" v1 "$T/f" "$T/keys/ana")16fails_with 'refs/releases/v1: only dami can update this' push_as ana "$T/w/a" origin "$c:refs/releases/v1"17FORGE_USER=ana fails_with 'only dami can update this' at "$T/w/a" "$FORGE" release publish v1 "$T/f/greet"18missing "$FORGE_WWW/dami/greet/releases"1920rm "$T/f/SHA256SUMS.sig"21c=$(release_commit "$T/w/a" v1 "$T/f")22ok push_as dami "$T/w/a" origin "$c:refs/releases/v1"23fails_with 'only dami can update this' push_as ana "$T/w/a" origin :refs/releases/v124exists "$FORGE_WWW/dami/greet/releases/download/v1/greet"2526# A collaborator may, with their own key.27mkdir -p "$FORGE_ROOT/dami/greet.git/forge"28printf 'ana\n' >"$FORGE_ROOT/dami/greet.git/forge/collaborators"29FORGE_USER=ana ok at "$T/w/a" "$FORGE" release publish v1 "$T/f/greet"30ok push_as ana "$T/w/a" origin :refs/releases/v131missing "$FORGE_WWW/dami/greet/releases/download/v1"