1 file changed, 61 insertions, 23 deletions
diff --git a/tests/t0110-snapshot.sh b/tests/t0110-snapshot.sh
index 125cb7f..6d59686 100755
--- a/tests/t0110-snapshot.sh
+++ b/tests/t0110-snapshot.sh
@@ -5,8 +5,8 @@
 # pipes through a compressor, and each compressed format needs the same tool
 # on the server and here, so one missing tool skips that format on both
 # grounds at once. The rest covers how a snapshot is named and found again from
-# its name, with a repository of its own for each set of refs, and the
-# requests that are refused.
+# its name, with a repository of its own for each set of refs, the signatures
+# kept in notes, and the requests that are refused.
 
 test_description='Verify snapshot'
 . ./setup.sh
@@ -335,32 +335,70 @@ test_expect_success 'a snapshot name leads to the tag ahead of a branch' '
 	test "$commit" = "$want"
 '
 
-# A signature is a note a pusher stored, held to max-blob-size like any blob.
-test_expect_success 'a signature past max-blob-size is refused' '
-	big=$(test_seq 1 2000 | git -C repos/vtags hash-object -w --stdin) &&
-	git -C repos/vtags notes --ref signatures/tar.gz add -C $big v1.0 &&
-	{
-		echo "max-blob-size=1" &&
-		cat vtagsrc
-	} >sigrc &&
-	cgit_rc sigrc "url=vtags/snapshot/vtags-1.0.tar.gz.asc" >tmp &&
-	grep "^Status: 413" tmp
-'
-
-test_expect_success 'a snapshot and its signature are linked as one unit' '
+# A signature is a note a pusher stored against the commit, served as it is
+# under headers that keep a browser from taking it for anything else, and held
+# to max-blob-size like any blob. A compressed tar with no signature of its
+# own offers the one made for the plain tar it expands to.
+test_expect_success 'set up a repo with signed snapshots' '
 	test_create_repo repos/signed &&
 	(
 		cd repos/signed &&
-		echo one >file &&
-		git add file &&
-		git commit -m one &&
-		git tag one &&
-		sig=$(echo signature | git hash-object -w --stdin) &&
-		git notes --ref signatures/tar.gz add -C $sig one
+		for tag in one two three big
+		do
+			git commit --allow-empty -m $tag &&
+			git tag $tag || return 1
+		done &&
+		echo signature >sig &&
+		sig=$(git hash-object -w sig) &&
+		git notes --ref signatures/tar.gz add -C $sig one &&
+		echo plain >plain &&
+		plain=$(git hash-object -w plain) &&
+		git notes --ref signatures/tar add -C $plain three &&
+		big=$(test_seq 1 2000 | git hash-object -w --stdin) &&
+		git notes --ref signatures/tar.gz add -C $big big
 	) &&
-	cgitrc_repo signedrc signed snapshots=tar.gz &&
-	cgit_rc signedrc "url=signed/refs/" >tmp &&
+	cgitrc_repo signedrc signed snapshots=tar.gz
+'
+
+test_expect_success 'a snapshot and its signature are linked as one unit' '
+	cgit_ok signedrc "url=signed/refs/" >tmp &&
 	grep "<span class=.snapshot.><a href=./signed/snapshot/signed-one.tar.gz.>signed-one.tar.gz</a> (<a href=./signed/snapshot/signed-one.tar.gz.asc.>sig</a>)</span>" tmp
 '
 
+test_expect_success 'a signature is served as the note holds it' '
+	cgit_ok signedrc "url=signed/snapshot/signed-one.tar.gz.asc" >tmp &&
+	sed "/^$/q" tmp >headers &&
+	grep "^Content-Type: application/pgp-signature$" headers &&
+	grep "^Content-Disposition: inline; filename=\"signed-one.tar.gz.asc\"$" headers &&
+	grep "^X-Content-Type-Options: nosniff$" headers &&
+	grep "^Content-Security-Policy: default-src .none.$" headers &&
+	strip_headers <tmp >actual &&
+	echo signature >expect &&
+	test_cmp expect actual
+'
+
+test_expect_success 'a ref with no signature has none to offer' '
+	cgit_ok signedrc "url=signed/refs/" >tmp &&
+	grep "<span class=.snapshot.><a href=./signed/snapshot/signed-two.tar.gz.>signed-two.tar.gz</a></span>" tmp &&
+	cgit_rc signedrc "url=signed/snapshot/signed-two.tar.gz.asc" >tmp &&
+	grep "^Status: 404" tmp &&
+	grep "<div class=.error.>No signature for signed-two.tar.gz</div>" tmp
+'
+
+test_expect_success 'a compressed tar offers the plain tar signature' '
+	cgit_ok signedrc "url=signed/refs/" >tmp &&
+	grep "<span class=.snapshot.><a href=./signed/snapshot/signed-three.tar.gz.>signed-three.tar.gz</a> (<a href=./signed/snapshot/signed-three.tar.asc.>sig</a>)</span>" tmp &&
+	cgit_ok signedrc "url=signed/snapshot/signed-three.tar.asc" >tmp &&
+	strip_headers <tmp >actual &&
+	echo plain >expect &&
+	test_cmp expect actual
+'
+
+test_expect_success 'a signature past max-blob-size is refused' '
+	cgitrc_repo sigrc signed snapshots=tar.gz max-blob-size=1 &&
+	cgit_rc sigrc "url=signed/snapshot/signed-big.tar.gz.asc" >tmp &&
+	grep "^Status: 413" tmp &&
+	cgit_ok sigrc "url=signed/snapshot/signed-one.tar.gz.asc" >tmp
+'
+
 test_done