Approvals are kept in the repository: indexed by state, kept by gc 3a4b3e018326

        self.reachable_approvals(&mut keep)?;

    /// Keep a signed approval (oxygenhub#235): verified, for this repository,

    /// with the signer's identity and indexed by the state it approves, so

    /// garbage collection keeps it while that state lives. Who may approve is

    /// the caller's rule.

    pub fn add_approval(&self, sa: &crate::approval::SignedApproval) -> Result<ObjectRef> {

        sa.verify()

            .map_err(|e| RepoError::Msg(format!("approval does not verify: {e}")))?;

        if sa.attest.repo != self.id()? {

            return fail("that approval is for another repository");

        }

        let state = sa

            .statement()

            .map_err(|e| RepoError::Msg(e.to_string()))?

            .state;

        self.store.put_identity(&sa.signer)?;

        let r = self.store.put_attest(&sa.attest)?;

        for sig in &sa.sigs {

            self.store.put_signature(&r, sig)?;

        }

        self.store.index_approval(&state, &r)?;

        Ok(r)

    }

    /// Approvals of states garbage collection keeps are kept, with their

    /// signatures and signers.

    pub(crate) fn reachable_approvals(&self, keep: &mut HashSet<ObjectRef>) -> Result<()> {

        for state in self.store.approval_states()? {

            if !keep.contains(&state) {

                let heads = match self.store.get_state(&state) {

                    Ok(s) => s.heads,

                    Err(StoreError::NotFound(_)) => vec![],

                    Err(e) => return Err(e.into()),

                };

                if !heads.iter().all(|h| keep.contains(h)) {

                    continue;

                }

                keep.insert(state);

            }

            for a in self.store.approvals_for(&state)? {

                keep.insert(a);

                for sig in self.store.signatures(&a)? {

                    keep.insert(sig.key);

                }

            }

        }

        Ok(())

    }

fn approvals_are_kept_with_their_state_and_survive_gc() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap().with_home(root.join("home"));

    write(root, "a.txt", b"1\n");

    repo.commit("A", &[]).unwrap();

    let heads = repo.bookmark_heads().unwrap();

    let state = repo.store().put_state(&StateObject::new(heads)).unwrap();

    let plan = repo.store_blob(b"the reviewed plan\n").unwrap();

    let sk = SecretKey::generate();

    let andy = sk.identity("Andy", "[email protected]", 1);

    let statement = crate::approval::Statement {

        repo: repo.id().unwrap(),

        run: "https://hub.example/andy/infra/flow/8".into(),

        job: "apply".into(),

        job_hash: ObjectRef([1; 32]),

        state,

        inputs: vec![plan],

        environment: "prod".into(),

        approve: true,

    };

    let sa = crate::approval::SignedApproval::sign(&statement, &andy, &sk);

    let r = repo.add_approval(&sa).unwrap();

    assert_eq!(repo.store().approvals_for(&state).unwrap(), vec![r]);

    // Another repository's approval, or a changed one, is refused.

    let elsewhere = crate::approval::SignedApproval::sign(

        &crate::approval::Statement {

            repo: [0; 16],

            ..statement.clone()

        },

        &andy,

        &sk,

    );

    assert!(repo

        .add_approval(&elsewhere)

        .unwrap_err()

        .to_string()

        .contains("another repository"));

    let mut forged = sa.clone();

    if let AttestBody::Approval { environment, .. } = &mut forged.attest.body {

        *environment = "dev".into();

    }

    assert!(repo

        .add_approval(&forged)

        .unwrap_err()

        .to_string()

        .contains("does not verify"));

    // gc keeps it, its signature and its signer while the state lives.

    repo.gc(true).unwrap();

    assert_eq!(repo.store().approvals_for(&state).unwrap(), vec![r]);

    assert_eq!(repo.store().get_attest(&r).unwrap(), sa.attest);

    assert_eq!(repo.store().signatures(&r).unwrap(), sa.sigs);

    assert!(repo.fsck().unwrap().problems.is_empty());

}

#[test]

    pub fn index_approval(&self, state: &ObjectRef, attest: &ObjectRef) -> Result<()> {

        self.index_add("approval", state, attest)

    }

    /// Approval attestations recorded for `state` (OxygenFlow approval

    /// gates, oxygenhub#235).

    pub fn approvals_for(&self, state: &ObjectRef) -> Result<Vec<ObjectRef>> {

        self.index_get("approval", "approvals", state)

    }

    /// Every state with an approval, for garbage collection.

    pub fn approval_states(&self) -> Result<Vec<ObjectRef>> {

        self.indexed_states("approval", "approvals")

    }

        self.indexed_states("receipt", "receipts")

    }

    /// The states an index (`one/<hh>/<rest>/<attest>` entries, and the

    /// packed `many/<hh>/<rest>` lists) holds attestations for.

    fn indexed_states(&self, one: &str, many: &str) -> Result<Vec<ObjectRef>> {

        for e in self.backend.list(&format!("{one}/")).map_err(backend_err)? {

        for e in self

            .backend

            .list(&format!("{many}/"))

            .map_err(backend_err)?

        {