1# A private repo's releases aren't in www: they go to the private root, for2# its readers on the web (release-private-web), and its readers get them3# over ssh as well (release ls, release get); to anyone else those commands4# say what they say about a repo that isn't there. A repo made private5# loses its public downloads.6. "$(dirname "$0")/../lib.sh"7user dami8user ana9user cat10repo --private dami/secret11ok ssh_as dami readers dami/secret add ana12clone dami dami/secret "$T/w/d"13at "$T/w/d" commit "first"14at "$T/w/d" git tag v115ok push_as dami "$T/w/d" origin main16mkdir "$T/f"17printf 'secret\000binary\n' >"$T/f/tool"18export FORGE_USER=dami19ok at "$T/w/d" "$FORGE" release publish v1 "$T/f/tool"20has "$T_LOG" 'release v1: /dami/secret/releases/download/v1/ for its readers, signed in or with a token \(ssh git@forge.test release get dami/secret v1 <file> works too\)'21unset FORGE_USER22missing "$FORGE_WWW/dami/secret"23ok cmp "$T/f/tool" "$FORGE_ROOT/.forge/private/www/dami/secret/releases/download/v1/tool"2425ssh_as ana release get dami/secret v1 tool >"$T/got" 2>"$T_LOG" || fail "a reader can't get it"26ok cmp "$T/f/tool" "$T/got"27ssh_as ana release get dami/secret v1 SHA256SUMS >"$T/sums" 2>"$T_LOG" || fail "a reader can't get SHA256SUMS"28ssh_as ana release get dami/secret v1 SHA256SUMS.sig >"$T/sums.sig" 2>"$T_LOG" || fail "a reader can't get SHA256SUMS.sig"29cp "$T/got" "$T/tool"30ok "$FORGE" release verify --repo dami/secret --tag v1 --signers "$FORGE_ROOT/.forge/allowed_signers" --sums "$T/sums" "$T/tool"31has "$T_LOG" '^ok tool: matches .* of dami/secret v1, signed by dami$'32ok ssh_as ana release ls dami/secret33eq "$(output)" "v1 SHA256SUMS $(wc -c <"$T/sums" | tr -d ' ') -34v1 SHA256SUMS.sig $(wc -c <"$T/sums.sig" | tr -d ' ') -35v1 tool $(wc -c <"$T/f/tool" | tr -d ' ') $(t_sha256 "$T/f/tool")"36fails_with 'no release v9 in dami/secret' ssh_as ana release get dami/secret v9 tool37fails_with 'release v1 of dami/secret has no file nope' ssh_as ana release get dami/secret v1 nope38fails_with 'has no file \.\./x' ssh_as ana release get dami/secret v1 ../x3940# Anyone else: the same words as for a missing repo, byte for byte.41for cmd in "release get dami/secret v1 tool" "release get dami/secret v9 tool" "release ls dami/secret"; do42 fails ssh_as cat "$cmd" </dev/null43 denied=$(output)44 aside dami/secret45 fails ssh_as cat "$cmd" </dev/null46 back dami/secret47 eq "$denied" "$(output)"48 eq "$denied" "forge: no repo dami/secret"49done5051# A public repo's: anyone gets them; once it is private, they aren't served.52repo dami/open53clone dami dami/open "$T/w/o"54at "$T/w/o" commit "first"55at "$T/w/o" git tag v156ok push_as dami "$T/w/o" origin main57FORGE_USER=dami ok at "$T/w/o" "$FORGE" release publish v1 "$T/f/tool"58ssh_as cat release get dami/open v1 tool >"$T/got" 2>"$T_LOG" || fail "anyone gets a public release"59ok cmp "$T/f/tool" "$T/got"60exists "$FORGE_WWW/dami/open/releases/download/v1/tool"61ok ssh_as dami private dami/open62missing "$FORGE_WWW/dami/open"63ok ssh_as cat help64has "$T_LOG" 'release get <owner>/<repo> <tag> <file>'