1# forge release verify checks downloads against SHA256SUMS, and SHA256SUMS2# against its signature for the release they come from (the download3# path, --url, or --repo and --tag) by a key of the forge, whose keys it4# gets from forge.allowedsigners, --signers or ssh <host> signers. It says5# which release it verified. A changed file, a rewritten SHA256SUMS, a6# signature by a stranger, for CI or none, or a file it doesn't list, fail.7. "$(dirname "$0")/../lib.sh"8user dami9user ana10repo dami/greet11clone dami dami/greet "$T/w/d"12at "$T/w/d" commit "first"13ok push_as dami "$T/w/d" origin main14at "$T/w/d" git tag v115mkdir "$T/f"16printf 'greet\000binary\n' >"$T/f/greet"17printf 'other\n' >"$T/f/other"18FORGE_USER=dami ok at "$T/w/d" "$FORGE" release publish v1 "$T/f/greet"19# As wget -x saves them: the path says which release.20dl=$T/dl/forge.test/dami/greet/releases/download/v121mkdir -p "$dl"22cp "$FORGE_WWW/dami/greet/releases/download/v1/"* "$dl/"23signers=$FORGE_ROOT/.forge/allowed_signers2425# In a clone, forge.allowedsigners says who signs.26ok at "$T/w/d" "$FORGE" release verify "$dl/greet"27has "$T_LOG" "^ok greet: matches .*/v1/SHA256SUMS of dami/greet v1, signed by dami$"28# Anywhere: --signers, or the forge's keys over ssh.29ok at "$T" "$FORGE" release verify --signers "$signers" "$dl/greet"30ok at "$T" env GIT_SSH_COMMAND="$T/ssh" FORGE_USER=ana "$FORGE" release verify --host "$FORGE_SSH" "$dl/greet"31has "$T_LOG" 'of dami/greet v1, signed by dami$'32# Files saved anywhere: the URL they came from, or the repo and tag.33mkdir "$T/elsewhere"34cp "$dl/greet" "$dl/SHA256SUMS" "$dl/SHA256SUMS.sig" "$T/elsewhere/"35fails_with 'which release is this' at "$T" "$FORGE" release verify --signers "$signers" "$T/elsewhere/greet"36ok at "$T" "$FORGE" release verify --signers "$signers" --url https://forge.test/dami/greet/releases/download/v1/greet "$T/elsewhere/greet"37ok at "$T" "$FORGE" release verify --signers "$signers" --repo dami/greet --tag v1 "$T/elsewhere/greet"38# In the clone the remote names the repo; the tag still has to be said.39ok at "$T/w/d" "$FORGE" release verify --tag v1 "$T/elsewhere/greet"40fails_with 'is not a good forge-release signature of .* for dami/greet v2' at "$T/w/d" "$FORGE" release verify --tag v2 "$T/elsewhere/greet"41fails_with "latest/ doesn't say which release" at "$T" "$FORGE" release verify --signers "$signers" --url https://forge.test/dami/greet/releases/download/latest/ "$T/elsewhere/greet"42s="--signers $signers --sums $dl/SHA256SUMS"4344# A changed file.45printf 'x' >>"$T/elsewhere/greet"46fails_with 'greet: DOES NOT MATCH its sha256' at "$T" "$FORGE" release verify $s "$T/elsewhere/greet"47# A file SHA256SUMS doesn't list.48cp "$T/f/other" "$dl/other"49fails_with 'other: not in' at "$T" "$FORGE" release verify --signers "$signers" "$dl/greet" "$dl/other"50# SHA256SUMS rewritten to match a changed file: its signature no longer does.51cp "$dl/SHA256SUMS" "$T/sums.good"52printf '%s greet\n' "$(t_sha256 "$T/elsewhere/greet")" >"$dl/SHA256SUMS"53fails_with 'SHA256SUMS.sig is not a good forge-release signature' at "$T" "$FORGE" release verify $s "$T/elsewhere/greet"54# Signed again, by a key the forge doesn't know.55ssh-keygen -q -t ed25519 -N '' -C eve -f "$T/keys/eve"56release_sign "$dl" "$T/keys/eve" dami/greet v157fails_with 'is not a good forge-release signature' at "$T" "$FORGE" release verify $s "$T/elsewhere/greet"58# By dami, but for CI results, not releases.59release_sign "$dl" "$T/keys/dami" dami/greet v1 forge-ci60fails_with 'is not a good forge-release signature' at "$T" "$FORGE" release verify $s "$T/elsewhere/greet"61# No signature at all.62cp "$T/sums.good" "$dl/SHA256SUMS"63rm "$dl/SHA256SUMS.sig"64fails_with 'SHA256SUMS.sig, so nothing vouches' at "$T" "$FORGE" release verify --signers "$signers" "$dl/greet"