1# SHA256SUMS.sig must be a forge-release signature of SHA256SUMS behind a2# header naming this repo and tag, by the key of the repo's owner or a3# collaborator: none, a stranger's, a registered non-admin's (even pushed4# by the owner), one for CI results, one of SHA256SUMS alone, or one of5# other text is refused. allowed_signers lets every key sign releases.6. "$(dirname "$0")/../lib.sh"7user dami8user ana9repo dami/greet10has "$FORGE_ROOT/.forge/allowed_signers" '^dami namespaces="forge-ci,forge-release,forge-review,git" ssh-ed25519 '11clone dami dami/greet "$T/w/d"12at "$T/w/d" commit "first"13at "$T/w/d" git tag v114ok push_as dami "$T/w/d" origin main v115ssh-keygen -q -t ed25519 -N '' -C eve -f "$T/keys/eve"16# files [key [namespace]]: a fresh release directory, signed for dami/greet v1 or not.17files() {18 rm -rf "$T/f"19 mkdir "$T/f"20 printf 'greet\n' >"$T/f/greet"21 printf '%s greet\n' "$(t_sha256 "$T/f/greet")" >"$T/f/SHA256SUMS"22 if [ $# -gt 0 ]; then release_sign "$T/f" "$1" dami/greet v1 "${2:-forge-release}"; fi23}24push() { c=$(release_commit "$T/w/d" v1 "$T/f" -) && push_as dami "$T/w/d" origin "$c:refs/releases/v1"; }25bad='release v1: SHA256SUMS.sig is not a good forge-release signature of SHA256SUMS for dami/greet v1 by a key of this forge'2627files28fails_with 'release v1: no SHA256SUMS.sig' push29files "$T/keys/eve"30fails_with "$bad" push31files "$T/keys/dami" forge-ci32fails_with "$bad" push33# SHA256SUMS alone, without the header.34files35ssh-keygen -q -Y sign -n forge-release -f "$T/keys/dami" "$T/f/SHA256SUMS" 2>/dev/null36fails_with "$bad" push37files38printf 'different text\n' >"$T/sig-other"39ssh-keygen -q -Y sign -n forge-release -f "$T/keys/dami" "$T/sig-other" 2>/dev/null40cp "$T/sig-other.sig" "$T/f/SHA256SUMS.sig"41fails_with "$bad" push4243# ana is registered but not an admin of dami/greet: her signature won't44# do, even when dami pushes it.45files "$T/keys/ana"46fails_with "release v1: SHA256SUMS.sig is ana's, and only dami and collaborators of dami/greet sign its releases" push47missing "$FORGE_WWW/dami/greet/releases"48# Once she is a collaborator, it does.49mkdir -p "$FORGE_ROOT/dami/greet.git/forge"50printf 'ana\n' >"$FORGE_ROOT/dami/greet.git/forge/collaborators"51ok push52exists "$FORGE_WWW/dami/greet/releases/download/v1/greet"