WIP #129: a tag's signer travels with the push (part 1 of 3) d8524a9f0117

        // A tag's signer travels with it, as the bookmark's does: a tag made

        // by `oxy tag create` under a short-lived key was signed by a key the

        // receiver has never seen, so its identity and certificate go too.

        let tag_signers: Vec<KeyId> = tags_to_send

            .iter()

            .filter_map(|t| t.attestation.as_ref())

            .flat_map(|a| a.sigs.iter().map(|s| s.key))

            .collect();

        for k in &tag_signers {

            if let Ok(id) = self.identity(k) {

                let body = id.encode();

                if !bundle

                    .objects

                    .iter()

                    .any(|(t, b)| *t == ObjectType::Identity && *b == body)

                {

                    bundle.objects.push((ObjectType::Identity, body));

                }

            }

        }

        if !tag_signers.is_empty() {

            self.attach_certificates_for(&mut bundle, &tag_signers)?;

        }

/// A tag made under one short-lived key and pushed under another: its

/// signer travels with the push (identity and certificate), so a receiver

/// that has never seen that key accepts it. A tag-only push by a keyless

/// agent was refused "unknown key" (found releasing OxygenFlow 0.2.0).

#[test]

fn a_tag_signed_by_an_earlier_short_lived_key_is_pushed() {

    use crate::cert::{Certificate, SignedCertificate};

    use crate::identity::Scope;

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let _origin = Repo::init(&root.join("origin")).unwrap();

    let url = root.join("origin").to_string_lossy().to_string();

    let mut a = Repo::clone(&url, &root.join("a"))

        .unwrap()

        .with_home(root.join("home-a"));

    a.create_identity("Ada", "[email protected]", IdentityScope::User)

        .unwrap();

    write(&root.join("a"), "a.txt", b"a\n");

    a.commit("a", &[]).unwrap();

    a.policy_init().unwrap();

    assert!(a.push("origin", false).unwrap().iter().all(|r| r.ok));

    let hub_sk = SecretKey::generate();

    let hub = hub_sk.identity("hub", "[email protected]", 1);

    a.policy_grant_subject(

        "agent:claude@ada",

        hub.clone(),

        Scope::CHANGES | Scope::REFS,

        Some("*"),

    )

    .unwrap();

    assert!(a.push("origin", false).unwrap().iter().all(|r| r.ok));

    let now = Hlc::now().wall_ms;

    let mut agent = Repo::clone(&url, &root.join("agent"))

        .unwrap()

        .with_home(root.join("home-agent"));

    agent.store().put_identity(&hub).unwrap();

    let certify = |agent: &Repo, id| {

        let cert = SignedCertificate::sign(

            Certificate {

                key: id,

                issuer: hub.hash(),

                subject: "agent:claude@ada".into(),

                claims: vec![],

                scope: Scope::CHANGES | Scope::REFS,

                not_before: now - 60_000,

                expires: now + 600_000,

                grant: None,

            },

            &hub,

            &hub_sk,

        );

        agent.store().put_certificate(&cert).unwrap();

    };

    // The tag, under the first short-lived key.

    let (first, first_id) = agent

        .create_identity("claude", "[email protected]", IdentityScope::User)

        .unwrap();

    certify(&agent, first_id);

    let heads = agent.bookmark_heads().unwrap();

    agent.tag_create("v1", &heads, "first").unwrap();

    // The push, under a second one (a later process's ten-minute key).

    let (second, second_id) = agent

        .create_identity("claude", "[email protected]", IdentityScope::User)

        .unwrap();

    assert_ne!(first, second);

    certify(&agent, second_id);

    agent

        .set_user_config("author.signer", &second.to_hex())

        .unwrap();

    let host = Repo::open(&root.join("origin")).unwrap();

    assert!(host.store().get_identity(&first).is_err(), "the host has never seen the tag's key");

    let r = agent.push("origin", false).unwrap();

    assert!(r.iter().all(|x| x.ok), "{r:?}");

    let host = Repo::open(&root.join("origin")).unwrap();

    assert!(host.tag_refs().unwrap().iter().any(|t| t.name == "v1"), "the tag arrived");

}