1# A private repo's release tree is extracted into .forge/private/store, under2# the directory only the forge can read, never into .forge/store, which the3# caddy user can read; its downloads in the private root, latest/ too, are4# hard links into it, the push's and the build's alike.5. "$(dirname "$0")/../lib.sh"6user dami7repo --private dami/secret8clone dami dami/secret "$T/w/d"9at "$T/w/d" commit "first"10at "$T/w/d" git tag v111ok push_as dami "$T/w/d" origin main12mkdir "$T/f"13printf 'secret tool\n' >"$T/f/tool"14FORGE_USER=dami ok at "$T/w/d" "$FORGE" release publish v1 "$T/f/tool"15tree=$(git --git-dir="$FORGE_ROOT/dami/secret.git" rev-parse 'refs/releases/v1^{tree}')16ps=$FORGE_ROOT/.forge/private/store/$tree17dl=$FORGE_ROOT/.forge/private/www/dami/secret/releases/download18inode() { ls -i "$1" | awk '{ print $1 }'; }19ok cmp "$T/f/tool" "$ps/tool"20exists "$ps/SHA256SUMS.sig"21missing "$FORGE_ROOT/.forge/store/$tree"22eq "$(inode "$dl/v1/tool")" "$(inode "$ps/tool")"23eq "$(inode "$dl/latest/tool")" "$(inode "$ps/tool")"24eq "$(ls -ld "$FORGE_ROOT/.forge/private" | cut -c1-10)" drwx------2526build dami/secret27eq "$(inode "$dl/v1/tool")" "$(inode "$ps/tool")"28eq "$(inode "$dl/latest/tool")" "$(inode "$ps/tool")"29missing "$FORGE_ROOT/.forge/store/$tree"30if find "$FORGE_ROOT/.forge/store" "$FORGE_WWW" -name tool | grep -q .; then fail "a private release file is in .forge/store or www"; fi