1# A release's signature names its repo and tag, so its files can't be2# passed off as another release's: v1's offered as v2 (a rollback), or a3# release copied into another repo, fail on the push and in forge release4# verify alike.5. "$(dirname "$0")/../lib.sh"6user dami7repo dami/greet8repo dami/other9clone dami dami/greet "$T/w/d"10at "$T/w/d" git remote add other "$FORGE_ROOT/dami/other.git"11at "$T/w/d" commit "first"12at "$T/w/d" git tag v113tick 360014at "$T/w/d" commit "second"15at "$T/w/d" git tag v216ok push_as dami "$T/w/d" origin main v217ok push_as dami "$T/w/d" other main v1 v218mkdir "$T/f"19printf 'greet 1\n' >"$T/f/greet"20FORGE_USER=dami ok at "$T/w/d" "$FORGE" release publish v1 "$T/f/greet"21g=$FORGE_ROOT/dami/greet.git22v1=$(git --git-dir="$g" rev-parse refs/releases/v1)23signers=$FORGE_ROOT/.forge/allowed_signers2425# v1's files, SHA256SUMS and signature (publish left them in the clone),26# committed as v2's release.27c=$(printf 'release v2\n\nTag: v2\nSource-Commit: %s\n' "$(git -C "$T/w/d" rev-parse v2)" | git -C "$T/w/d" commit-tree "$v1^{tree}")28fails_with 'release v2: SHA256SUMS.sig is not a good forge-release signature of SHA256SUMS for dami/greet v2' push_as dami "$T/w/d" origin "$c:refs/releases/v2"29missing "$FORGE_WWW/dami/greet/releases/download/v2"30# The same files downloaded into v2's place, or said to be v2's.31v2dl=$T/dl/dami/greet/releases/download/v232mkdir -p "$v2dl"33cp "$FORGE_WWW/dami/greet/releases/download/v1/"* "$v2dl/"34fails_with 'is not a good forge-release signature of .* for dami/greet v2' "$FORGE" release verify --signers "$signers" "$v2dl/greet"35fails_with 'for dami/greet v2' "$FORGE" release verify --signers "$signers" --repo dami/greet --tag v2 "$v2dl/greet"36ok "$FORGE" release verify --signers "$signers" --tag v1 --repo dami/greet "$v2dl/greet"3738# The v1 release itself, copied to dami/other, where v1 is the same commit.39fails_with 'release v1: SHA256SUMS.sig is not a good forge-release signature of SHA256SUMS for dami/other v1' push_as dami "$T/w/d" other "$v1:refs/releases/v1"40missing "$FORGE_WWW/dami/other/releases"41fails_with 'for dami/other v1' "$FORGE" release verify --signers "$signers" --repo dami/other --tag v1 "$v2dl/greet"