A tag can be withdrawn, by a signed withdrawal (oxygenhub#301) b63fc7a77fc6

    /// Tag `name`, naming `state`, is withdrawn (spec §10.1): signed by a

    /// key the policy lets create the tag. The name is never used again.

    Untag {

        name: String,

        state: ObjectRef,

        reason: String,

    },

            AttestBody::Untag { .. } => "untag",

            ]),

            AttestBody::Untag {

                name,

                state,

                reason,

            } => Value::map([

                (0, Value::Text(name.clone())),

                (1, Value::Bytes(state.0.to_vec())),

                (2, Value::Text(reason.clone())),

            "untag" => AttestBody::Untag {

                name: text(field(b, 0, "name")?, "name")?.to_owned(),

                state: oref(field(b, 1, "state")?, "state")?,

                reason: text(field(b, 2, "reason")?, "reason")?.to_owned(),

            },

        let u = Attest {

            repo: [1; 16],

            hlc: Hlc::default(),

            body: AttestBody::Untag {

                name: "v1".into(),

                state: ObjectRef([5; 32]),

                reason: "tagged the wrong change".into(),

            },

        };

        assert_eq!(Attest::decode(&u.encode()).unwrap(), u);

        assert_eq!(u.kind(), "untag");

        assert_ne!(u.hash(), t.hash());

    /// Tags withdrawn here (spec §10.1; key 8, only when there are any):

    /// each with its `untag` attestation as `attestation`, and that

    /// attestation's acceptance as `accepted` when a short-lived key

    /// signed it. Older clients ignore them and keep the tag they have.

    pub withdrawn: Vec<TagRef>,

    /// Whether this is a tag's withdrawal (its attestation an `untag`), as

    /// a push carries one (oxygenhub#301).

    pub fn is_withdrawal(&self) -> bool {

        self.attestation

            .as_ref()

            .is_some_and(|a| matches!(a.attest.body, crate::attest::AttestBody::Untag { .. }))

    }

            }

            if !resp.withdrawn.is_empty() {

                m.insert(8, tags_value(&resp.withdrawn));

        let withdrawn = match m.get(&8) {

            Some(t) => tags_from(t)?,

            None => Vec::new(),

        };

                withdrawn,

            withdrawn: vec![],

    /// Create tag `name` for the state of `heads` as a host does for a

    /// signed-in user (oxygenhub#295): attested by `signer` (a delegate of

    /// the user, or the host's own key), with `identities` it needs, and

    /// received as a pushed tag is, so the same policy checks apply.

    pub fn host_tag_create(

        &self,

        name: &str,

        heads: &[ChangeHash],

        message: &str,

        signer: (&KeyId, &SecretKey),

        identities: &[Identity],

    ) -> Result<PushReport> {

        crate::objects::validate_name(name)

            .map_err(|e| RepoError::Msg(format!("tag name: {e}")))?;

        let st = self.load_state_history(heads)?;

        let heads = st.maximal(heads);

        if heads.is_empty() {

            return fail("a tag needs at least one change");

        }

        let state_object = StateObject::new(heads.clone());

        let state = state_object.hash();

        let body = AttestBody::Tag {

            name: name.into(),

            state,

            message: message.into(),

        };

        let mut bundle = self.hosted_bundle(identities);

        bundle

            .objects

            .push((ObjectType::State, state_object.encode()));

        let t = crate::protocol::TagRef::new(

            name.into(),

            state,

            heads,

            Some(self.host_attest(body, signer)?),

        );

        self.receive_push_report(bundle, vec![], None, vec![t])

    }

    /// Withdraw tag `name` as a host does for a signed-in user

    /// (oxygenhub#301): an `untag` attestation by `signer`, received as a

    /// pushed withdrawal is.

    pub fn host_tag_withdrawal(

        &self,

        name: &str,

        reason: &str,

        signer: (&KeyId, &SecretKey),

        identities: &[Identity],

    ) -> Result<PushReport> {

        let Some(state) = self.view()?.tags.get(name).copied() else {

            return fail(format!("no tag {name:?}"));

        };

        let body = AttestBody::Untag {

            name: name.into(),

            state,

            reason: reason.into(),

        };

        let t = crate::protocol::TagRef::new(

            name.into(),

            state,

            vec![],

            Some(self.host_attest(body, signer)?),

        );

        self.receive_push_report(self.hosted_bundle(identities), vec![], None, vec![t])

    }

    fn host_attest(

        &self,

        body: AttestBody,

        (key, sk): (&KeyId, &SecretKey),

    ) -> Result<SignedAttest> {

        let attest = Attest {

            repo: self.id()?,

            hlc: Hlc::now(),

            body,

        };

        let sig = sk.sign(Domain::Attest, key, &attest.hash());

        Ok(SignedAttest {

            attest,

            sigs: vec![sig],

        })

    }

    fn hosted_bundle(&self, identities: &[Identity]) -> Bundle {

        let mut bundle = Bundle::default();

        for id in identities {

            bundle.objects.push((ObjectType::Identity, id.encode()));

        }

        bundle

    }

    /// Tags the remote withdrew, and so withdrawn here (oxygenhub#301).

    pub withdrawn_tags: Vec<String>,

            withdrawn: self.withdrawn_refs()?,

            if t.is_withdrawal() {

                match self.adopt_withdrawal(&mut view, t, policy.as_ref(), &mut TagCheck::Received)

                {

                    Ok(removed) => {

                        // A withdrawal is an update to nothing, as a

                        // bookmark's deletion is.

                        if removed {

                            report.updated.push(RefUpdated {

                                name: name.clone(),

                                old_state: t.state,

                                new_state: ObjectRef::ZERO,

                                heads: vec![],

                            });

                        }

                        names.push(name.clone());

                        results.push(RefResult {

                            name,

                            ok: true,

                            reason: if removed {

                                "withdrawn"

                            } else {

                                "already withdrawn"

                            }

                            .into(),

                        });

                    }

                    Err(e) => results.push(RefResult {

                        name,

                        ok: false,

                        reason: e.reason,

                    }),

                }

                continue;

            }

                continue;

            }

            // Withdrawn here: the name is not used again.

            if self.tag_withdrawal(&t.name)?.is_some() {

        // The remote withdrew a tag this repository has: so does this one,

        // once the withdrawal is checked as a push's would be; one that is

        // not is left as it is, said so (oxygenhub#301).

        let mut withdrawn_tags = Vec::new();

        for t in &resp.withdrawn {

            if !view.tags.contains_key(&t.name) {

                continue;

            }

            let mut check = TagCheck::Fetched {

                remote: remote_name,

                log: &log,

                notes: &mut log_notes,

            };

            match self.adopt_withdrawal(&mut view, t, policy.as_ref(), &mut check) {

                Ok(true) => withdrawn_tags.push(t.name.clone()),

                Ok(false) => {}

                Err(e) => skipped.push((

                    format!("tags/{}", t.name),

                    format!("withdrawn on {remote_name}, kept here: {}", e.reason),

                )),

            }

        }

            withdrawn_tags,

        }

    }

    /// Withdraw tag `tag` on `remote_name` (`oxy push --delete tags/NAME`,

    /// oxygenhub#301): withdrawn here first when it still is a tag here

    /// (`oxy tag delete`), then the withdrawal alone is sent, with its

    /// signer's identity and certificate.

    pub fn push_tag_withdrawal(&self, remote_name: &str, tag: &str) -> Result<Vec<RefResult>> {

        let remote = self.open_named_remote(remote_name)?;

        self.check_remote_id(remote.as_ref(), remote_name, true)?;

        let resp = remote.refs()?;

        let name = format!("tags/{tag}");

        if resp.withdrawn.iter().any(|t| t.name == tag) {

            return Ok(vec![RefResult {

                name,

                ok: true,

                reason: "already withdrawn".into(),

            }]);

        }

        let Some(there) = resp.tags.iter().find(|t| t.name == tag) else {

            return fail(format!("{remote_name} has no tag {tag}"));

        };

        if resp.policy.is_some() && self.secret_key()?.is_none() {

            return fail(format!("{remote_name} enforces a trust policy; withdrawing a tag needs an identity (`oxy identity create`)"));

        if self.tag_withdrawal(tag)?.is_none() {

            match self.view()?.tags.get(tag) {

                Some(st) if *st == there.state => {

                    self.tag_delete(tag, "")?;

                }

                Some(_) => {

                    return fail(format!(

                        "tag {tag} names another state here than on {remote_name}"

                    ))

                }

                None => {

                    return fail(format!(

                        "there is no tag {tag} here to withdraw: `oxy fetch {remote_name}` first"

                    ))

                }

            }

        }

        let Some(w) = self

            .withdrawn_refs()?

            .into_iter()

            .find(|w| w.name == tag && w.state == there.state)

        else {

            return fail(format!(

                "tag {tag} was withdrawn here at another state than {remote_name}'s"

            ));

        };

        let mut bundle = Bundle::default();

        let signers: Vec<KeyId> = w

            .attestation

            .iter()

            .flat_map(|a| a.sigs.iter().map(|s| s.key))

            .collect();

        for k in &signers {

            if let Ok(id) = self.identity(k) {

                bundle.objects.push((ObjectType::Identity, id.encode()));

            }

        }

        self.attach_certificates_for(&mut bundle, &signers)?;

        remote.push(bundle, vec![], None, vec![w])

        if let Some(tag) = bookmark.strip_prefix("tags/") {

            return self.push_tag_withdrawal(remote_name, tag);

        }

        let remote_tags: BTreeSet<String> = resp

            .tags

            .iter()

            .chain(&resp.withdrawn)

            .map(|t| t.name.clone())

            .collect();

            .collect();

        // Tags withdrawn here that the remote still has, at the same state

        // (oxygenhub#301).

        let withdrawals_to_send: Vec<crate::protocol::TagRef> = self

            .withdrawn_refs()?

            .into_iter()

            .filter(|w| {

                resp.tags

                    .iter()

                    .any(|t| t.name == w.name && t.state == w.state)

            })

        if new_state == remote_state

            && policy_to_send.is_none()

            && tags_to_send.is_empty()

            && withdrawals_to_send.is_empty()

        {

            .chain(&withdrawals_to_send)

            tags_to_send

                .into_iter()

                .chain(withdrawals_to_send)

                .collect(),

//! server refuses a second attestation for an existing tag name. A tag is

//! withdrawn by a signed `untag` attestation (oxygenhub#301), kept beside

//! its creation; the name is not used again.

    fn tag_withdrawal_path(&self, name: &str) -> PathBuf {

        self.oxy.join("attest").join("untags").join(name_file(name))

    }

    /// The withdrawal of tag `name`, when it was withdrawn here.

    pub fn tag_withdrawal(&self, name: &str) -> Result<Option<(ObjectRef, SignedAttest)>> {

        match fs::read_to_string(self.tag_withdrawal_path(name)) {

            Ok(h) => {

                let r = ObjectRef::from_hex(h.trim())

                    .ok_or_else(|| RepoError::Msg("corrupt tag withdrawal pointer".into()))?;

                Ok(Some((

                    r,

                    SignedAttest {

                        attest: self.store.get_attest(&r)?,

                        sigs: self.store.signatures(&r)?,

                    },

                )))

            }

            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),

            Err(e) => Err(e.into()),

        }

    }

    fn set_tag_withdrawal(&self, name: &str, r: &ObjectRef) -> Result<()> {

        fs::create_dir_all(self.oxy.join("attest").join("untags"))?;

        write_atomic(&self.tag_withdrawal_path(name), r.to_hex().as_bytes())

    }

    /// Withdraw tag `name` (spec §10.1): an `untag` attestation naming its

    /// state, signed when this repository has a key, and the tag leaves the

    /// view. The next push sends the withdrawal to a remote that still has

    /// the tag, under a policy only when the key may create the tag there.

    pub fn tag_delete(&self, name: &str, reason: &str) -> Result<TagInfo> {

        let (op_ref, op) = self.head_op()?;

        let Some(state) = op.view.tags.get(name).copied() else {

            return fail(format!("no tag {name:?}"));

        };

        let heads = self.store.get_state(&state)?.heads;

        let attest = Attest {

            repo: self.id()?,

            hlc: Hlc::now(),

            body: AttestBody::Untag {

                name: name.into(),

                state,

                reason: reason.into(),

            },

        };

        let mut signer = None;

        let r = if self.secret_key()?.is_some() {

            let sa = self.sign_attest(&attest)?;

            signer = sa

                .sigs

                .first()

                .and_then(|s| self.store.get_identity(&s.key).ok())

                .map(|i| i.name);

            sa.attest.hash()

        } else {

            self.store.put_attest(&attest)?

        };

        self.set_tag_withdrawal(name, &r)?;

        let mut view = op.view.clone();

        view.tags.remove(name);

        self.record_op(&[op_ref], &format!("oxy tag delete {name}"), view)?;

        Ok(TagInfo {

            name: name.into(),

            state,

            heads,

            message: reason.into(),

            signer,

        })

    }

    /// Every tag withdrawn here, as `refs` reports them: the `untag`

    /// attestation as the attestation, with its acceptance when a

    /// short-lived key signed it.

    pub(crate) fn withdrawn_refs(&self) -> Result<Vec<crate::protocol::TagRef>> {

        let dir = self.oxy.join("attest").join("untags");

        let entries = match fs::read_dir(&dir) {

            Ok(e) => e,

            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(vec![]),

            Err(e) => return Err(e.into()),

        };

        let mut out = Vec::new();

        for e in entries {

            let e = e?;

            let Ok(h) = fs::read_to_string(e.path()) else {

                continue;

            };

            let Some(r) = ObjectRef::from_hex(h.trim()) else {

                continue;

            };

            let sa = SignedAttest {

                attest: self.store.get_attest(&r)?,

                sigs: self.store.signatures(&r)?,

            };

            let AttestBody::Untag { name, state, .. } = &sa.attest.body else {

                continue;

            };

            let heads = self

                .store

                .get_state(state)

                .map(|s| s.heads)

                .unwrap_or_default();

            let accepted = self.tag_acceptance(&sa)?;

            let mut t = crate::protocol::TagRef::new(name.clone(), *state, heads, Some(sa));

            t.accepted = accepted;

            out.push(t);

        }

        out.sort_by(|a, b| a.name.cmp(&b.name));

        Ok(out)

    }

        }

        if self.tag_withdrawal(name)?.is_some() {

            return fail(format!(

                "tag {name:?} was withdrawn; a withdrawn tag's name is not used again"

            ));

        if self

            .tag_withdrawal(&t.name)

            .map_err(|e| e.to_string())?

            .is_some()

        {

            return Err(format!(

                "tag {:?} was withdrawn here; a withdrawn tag's name is not used again",

                t.name

            )

            .into());

        }

    }

    /// Adopt the withdrawal of tag `t` (its `attestation` the `untag`

    /// attestation), received in a push or fetched: the tag must be here

    /// with the state the withdrawal names, and under a policy its signer

    /// must be one that may create the tag, a short-lived key at the time

    /// `check` says (as for creating it, except that a fetch checks at the

    /// issuer's acceptance only). The tag leaves `view` and the withdrawal

    /// is kept. Whether the tag was here and is now withdrawn: a withdrawal

    /// already kept is `false`.

    pub(crate) fn adopt_withdrawal(

        &self,

        view: &mut View,

        t: &crate::protocol::TagRef,

        policy: Option<&crate::policy::Policy>,

        check: &mut TagCheck,

    ) -> std::result::Result<bool, TagRefusal> {

        let sa = t

            .attestation

            .as_ref()

            .ok_or("a tag withdrawal carries no attestation")?;

        let AttestBody::Untag { name, state, .. } = &sa.attest.body else {

            return Err("tag withdrawal has the wrong kind".into());

        };

        if *name != t.name || *state != t.state {

            return Err("tag withdrawal does not describe this tag".into());

        }

        if sa.attest.repo != self.id().map_err(|e| e.to_string())? {

            return Err("tag withdrawal is for a different repository".into());

        }

        if self

            .tag_withdrawal(&t.name)

            .map_err(|e| e.to_string())?

            .is_some()

        {

            return Ok(false);

        }

        match view.tags.get(&t.name) {

            None => return Err(format!("there is no tag {:?} here", t.name).into()),

            Some(st) if *st != t.state => {

                return Err(format!(

                    "the withdrawal names another state of tag {:?} than this repository's",

                    t.name

                )

                .into())

            }

            Some(_) => {}

        }

        let r = sa.attest.hash();

        let mut certified = false;

        if let Some(sig) = sa.sigs.first() {

            let id = self

                .store

                .get_identity(&sig.key)

                .map_err(|_| format!("unknown key {}", sig.key.short(12)))?;

            verify_signature(&id, sig, Domain::Attest, &r).map_err(|e| e.to_string())?;

            certified = self.store.certificate_of(&sig.key).ok().flatten().is_some();

            if let Some(p) = policy {

                let accepted = self.issuer_acceptance(&sig.key, sa, t.accepted.as_ref());

                let reference = format!("tags/{}", t.name);

                let in_time =

                    |ms: u64| self.certified_authorized(p, &sig.key, &reference, Scope::REFS, ms);

                let allowed = self.tag_signer_listed(p, &t.name, sa)

                    || (certified

                        && match check {

                            TagCheck::Received => {

                                in_time(Hlc::now().wall_ms) || accepted.is_some_and(in_time)

                            }

                            TagCheck::Mirrored => {

                                in_time(accepted.unwrap_or(sa.attest.hlc.wall_ms))

                            }

                            TagCheck::Fetched { remote, .. } => match accepted {

                                Some(ms) => in_time(ms),

                                None => {

                                    return Err(TagRefusal {

                                        reason: format!(

                                            "withdrawn by short-lived key {}, and {remote} gave no acceptance to check its certificate at",

                                            sig.key.short(12)

                                        ),

                                        untimed: true,

                                    })

                                }

                            },

                        });

                if !allowed {

                    return Err(format!(

                        "key {} may not withdraw tags/{} under this repository's policy",

                        sig.key.short(12),

                        t.name

                    )

                    .into());

                }

            }

        } else if policy.is_some() {

            return Err(format!(

                "withdrawing tag {:?} needs a signed attestation under this repository's policy",

                t.name

            )

            .into());

        }

        let stored = self

            .store

            .put_attest(&sa.attest)

            .map_err(|e| e.to_string())?;

        for s in &sa.sigs {

            self.store

                .put_signature(&stored, s)

                .map_err(|e| e.to_string())?;

        }

        if certified {

            match &t.accepted {

                Some(acc)

                    if sa.sigs.first().is_some_and(|s| {

                        self.issuer_acceptance(&s.key, sa, Some(acc)).is_some()

                    }) =>

                {

                    self.keep_acceptance(&stored, acc)

                }

                _ if matches!(check, TagCheck::Received) => self.record_acceptance(&stored),

                _ => Ok(()),

            }

            .map_err(|e| e.to_string())?;

        }

        self.set_tag_withdrawal(&t.name, &stored)

            .map_err(|e| e.to_string())?;

        view.tags.remove(&t.name);

        Ok(true)

fn a_tag_is_withdrawn_by_a_signed_withdrawal() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let origin = Repo::init(&root.join("origin")).unwrap();

    let url = root.join("origin").to_string_lossy().to_string();

    let mut a = Repo::clone(&url, &root.join("a"))

        .unwrap()

        .with_home(root.join("home-a"));

    a.create_identity("Ada", "[email protected]", IdentityScope::User)

        .unwrap();

    write(&root.join("a"), "f.txt", b"1\n");

    let h1 = a.commit("one", &[]).unwrap();

    a.tag_create("v1", &[h1], "first release").unwrap();

    a.tag_create("v2", &[h1], "").unwrap();

    a.policy_init().unwrap();

    a.push("origin", false).unwrap();

    origin.refresh().unwrap();

    let original = a

        .tag_refs()

        .unwrap()

        .into_iter()

        .find(|t| t.name == "v1")

        .unwrap();

    let b = Repo::clone(&url, &root.join("b"))

        .unwrap()

        .with_home(root.join("home-b"));

    assert_eq!(b.tag_heads("v1").unwrap(), Some(vec![h1]));

    // A key the policy does not let create the tag may not withdraw it.

    let mut c = Repo::clone(&url, &root.join("c"))

        .unwrap()

        .with_home(root.join("home-c"));

    c.create_identity("Cy", "[email protected]", IdentityScope::User)

        .unwrap();

    let r = c.push_delete("origin", "tags/v1").unwrap();

    assert!(

        !r[0].ok && r[0].reason.contains("may not withdraw"),

        "{r:?}"

    );

    assert_eq!(c.tag_heads("v1").unwrap(), None, "withdrawn there first");

    origin.refresh().unwrap();

    assert_eq!(origin.tag_heads("v1").unwrap(), Some(vec![h1]));

    // Its creator's key may: the tag goes, the withdrawal stays.

    let r = a.push_delete("origin", "tags/v1").unwrap();

    assert!(r[0].ok && r[0].reason == "withdrawn", "{r:?}");

    origin.refresh().unwrap();

    assert_eq!(origin.tag_heads("v1").unwrap(), None);

    assert_eq!(a.tag_heads("v1").unwrap(), None);

    assert!(origin.tag_withdrawal("v1").unwrap().is_some());

    assert!(origin.tag_attest("v1").unwrap().is_some(), "kept beside it");

    let refs = origin.remote_refs().unwrap();

    assert!(refs.tags.iter().all(|t| t.name != "v1"));

    assert_eq!(refs.withdrawn.len(), 1);

    let r = a.push_delete("origin", "tags/v1").unwrap();

    assert!(r[0].ok && r[0].reason == "already withdrawn", "{r:?}");

    // A fetch withdraws it too, and the name is never used again.

    let rep = b.fetch("origin").unwrap();

    assert_eq!(rep.withdrawn_tags, vec!["v1".to_string()]);

    assert_eq!(b.tag_heads("v1").unwrap(), None);

    assert!(b.tag_create("v1", &[h1], "").is_err());

    let r = origin

        .receive_push(Bundle::default(), vec![], None, vec![original])

        .unwrap();

    assert!(!r[0].ok && r[0].reason.contains("withdrawn"), "{r:?}");

    // `oxy tag delete`, then a plain push, sends it.

    a.tag_delete("v2", "tagged too early").unwrap();

    let r = a.push("origin", false).unwrap();

    assert!(

        r.iter()

            .any(|x| x.name == "tags/v2" && x.ok && x.reason == "withdrawn"),

        "{r:?}"

    );

    origin.refresh().unwrap();

    assert_eq!(origin.tag_heads("v2").unwrap(), None);

    let (_, w) = origin.tag_withdrawal("v2").unwrap().unwrap();

    assert!(

        matches!(&w.attest.body, AttestBody::Untag { reason, .. } if reason == "tagged too early")

    );

}

#[test]

    /// Whether tag `tag` of `name` may be withdrawn (oxygenhub#301): called

    /// for each withdrawal a push carries, before the repository sees it.

    /// A host refuses one it depends on (a forge's release names the tag)

    /// with the reason, which is that withdrawal's result. The default

    /// allows every one; the policy is checked after, as for any push.

    fn vet_tag_withdrawal(&self, _name: &str, _tag: &str) -> Result<(), String> {

        Ok(())

    }

                let mut kept_tags = Vec::new();

                let mut withdrawals_refused = Vec::new();

                for t in tags {

                    match t

                        .is_withdrawal()

                        .then(|| self.backend.vet_tag_withdrawal(name, &t.name))

                    {

                        Some(Err(reason)) => withdrawals_refused.push((t.name, reason)),

                        _ => kept_tags.push(t),

                    }

                }

                let mut report = r.receive_push_report(bundle, updates, policy, kept_tags)?;

                if !refused.is_empty() || !withdrawals_refused.is_empty() {

                    });

                }

                for (tag, reason) in withdrawals_refused {

                    report.results.push(oxy_core::protocol::RefResult {

                        name: format!("tags/{tag}"),

                        ok: false,

                        reason,

| Refs response | `{0: [ref], 1: repo id, 2: signed policy or null, 3: [tag], 4: [signed policy], 8: [tag]}`; key 8 (optional, only when there are any; oxygenhub#301) lists the tags withdrawn there, each a tag whose attestation is its `untag` attestation and whose key 4 is that attestation's acceptance when a short-lived key signed it; older readers ignore it |

| Push request | `{0: Bundle, 1: [update], 2: signed policy or null, 3: [tag]}`; a tag whose attestation is an `untag` attestation withdraws that tag (oxygenhub#301), reported as `tags/<name>`; an older server refuses it as an attestation of the wrong kind |

tags/<name>                      tags (immutable once created; may be withdrawn)

**Withdrawing a tag** (oxygenhub#301). A tag is never moved, but it can be withdrawn: `oxy tag delete NAME [-r REASON]` records an attestation of kind `untag`, `{0: name, 1: state, 2: reason}`, naming the tag's state and signed by the repository's key, and the tag leaves the view; its `tag` attestation stays beside the withdrawal. The next `oxy push` sends the withdrawal to a remote that lists the tag at that state (`oxy push REMOTE --delete tags/NAME` withdraws it here and there at once), in the push's tags as a tag whose attestation is the withdrawal. A receiver adopts a withdrawal only of a tag it holds at the state named; under a policy the signer MUST be a key the rule for `tags/<name>` authorizes to create the tag (a listed key, its delegate, a rotation predecessor, or a short-lived key under a subject grant, at the receiver's clock on a push and at its issuer's acceptance on a fetch), and an unsigned withdrawal is refused. A server lists the tags withdrawn there in its `refs` answer (`withdrawn`), and a fetch withdraws a tag this repository holds at the same state when the withdrawal verifies, noting it, and otherwise keeps the tag, saying why. A withdrawn name is never used again: `tag create`, a push and a fetch refuse or skip a tag of that name, so a tag name never names two states. A host MAY refuse to withdraw a tag it depends on (the reference server's `Backend::vet_tag_withdrawal`; a forge refuses while a release names the tag).

        /// the local bookmark is kept. `tags/NAME` withdraws a tag there

        /// (and here, as `oxy tag delete` does)

    /// Withdraw a tag: a signed withdrawal, kept beside the tag's creation;

    /// `oxy push` sends it to a remote that has the tag (the name is never

    /// used again)

    Delete {

        /// Name of the tag

        name: String,

        /// Why it is withdrawn, recorded with the withdrawal

        #[arg(short, long, default_value = "")]

        reason: String,

    },

            TagCmd::Delete { name, reason } => workspace::tag_delete(&name, &reason),

                (

                    "withdrawn_tags",

                    json::arr(report.withdrawn_tags.iter().map(|n| json::s(n))),

                ),

    for t in &report.withdrawn_tags {

        println!(

            "  {} {}",

            ui::note(),

            ui::dim(format!("tag {t} was withdrawn on {remote}, and here"))

        );

    }

            let done = if r.name.starts_with("tags/") {

                "Withdrew"

            } else {

                "Deleted"

            };

                ui::done(done),

pub fn tag_delete(name: &str, reason: &str) -> Result<i32> {

    let repo = open()?;

    let t = repo.tag_delete(name, reason)?;

    println!(

        "{} {} {} {}{}",

        ui::done("Withdrew"),

        ui::bookmark(&t.name),

        ui::dim(ui::glyph("→", "->")),

        ui::hash(format!("#{}", t.state.short(12))),

        t.signer

            .map(|s| format!(", signed by {s}"))

            .unwrap_or_else(|| ui::dim(", unsigned"))

    );

    println!(

        "  {} {}",

        ui::note(),

        ui::dim("`oxy push` sends the withdrawal to a remote that has the tag; the name is not used again")

    );

    Ok(0)

}