From 4e4edf0d8c781453e0ac903dca29dd647988c41a Mon Sep 17 00:00:00 2001
From: Renovate Bot <bot@kriese.eu>
Date: Sun, 8 Dec 2024 00:02:10 +0000
Subject: [PATCH 01/14] Update actions/setup-forgejo action to v2.0.4

---
 .forgejo/workflows/integration.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.forgejo/workflows/integration.yml b/.forgejo/workflows/integration.yml
index 3e9bb66..ced0ae6 100644
--- a/.forgejo/workflows/integration.yml
+++ b/.forgejo/workflows/integration.yml
@@ -6,7 +6,7 @@ jobs:
       - uses: actions/checkout@v3
 
       - id: forgejo
-        uses: https://code.forgejo.org/actions/setup-forgejo@v2.0.3
+        uses: https://code.forgejo.org/actions/setup-forgejo@v2.0.4
         with:
           user: testuser
           password: admin1234

From 4d26949b75e208a9d85204fdd1d6685af0f876a8 Mon Sep 17 00:00:00 2001
From: Crown0815 <crown0815@noreply.code.forgejo.org>
Date: Mon, 9 Dec 2024 05:38:35 +0000
Subject: [PATCH 02/14] Add support for files with spaces in their names (#24)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

So far when uploading files containing spaces, such as `file 3.txt`, the `tea` command will be broken due to incorrectly formatted `tea` arguments.
I have been receiving `Remote repository required: Specify ID via --repo or execute from a local git repo.` which was not helpful until I turned on `verbose` and saw the whole command.

This fix should resolve this issue and thereby add active support for files with spaces.

Co-authored-by: Felix Kröner <felix.kroener@dynamic-biosensors.com>
Reviewed-on: https://code.forgejo.org/actions/forgejo-release/pulls/24
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Crown0815 <crown0815@noreply.code.forgejo.org>
Co-committed-by: Crown0815 <crown0815@noreply.code.forgejo.org>
---
 .gitignore                                    |   1 +
 forgejo-release.sh                            | 117 +++++++++---------
 .../upload-download/upload-dir/file 3.txt     |   1 +
 3 files changed, 63 insertions(+), 56 deletions(-)
 create mode 100644 testdata/upload-download/upload-dir/file 3.txt

diff --git a/.gitignore b/.gitignore
index b25c15b..f166652 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 *~
+.idea
diff --git a/forgejo-release.sh b/forgejo-release.sh
index 3b1e4b1..8abb54e 100755
--- a/forgejo-release.sh
+++ b/forgejo-release.sh
@@ -22,43 +22,48 @@ if ${VERBOSE:-false}; then set -x; fi
 export GNUPGHOME
 
 setup_tea() {
-    if ! test -f $BIN_DIR/tea ; then
-	ARCH=$(dpkg --print-architecture)
-	curl -sL https://dl.gitea.io/tea/$TEA_VERSION/tea-$TEA_VERSION-linux-$ARCH > $BIN_DIR/tea
-	chmod +x $BIN_DIR/tea
+    if ! test -f "$BIN_DIR"/tea ; then
+    ARCH=$(dpkg --print-architecture)
+    curl -sL https://dl.gitea.io/tea/$TEA_VERSION/tea-$TEA_VERSION-linux-"$ARCH" > "$BIN_DIR"/tea
+    chmod +x "$BIN_DIR"/tea
     fi
 }
 
 ensure_tag() {
-    if api GET repos/$REPO/tags/$TAG > $TMP_DIR/tag.json ; then
-	local sha=$(jq --raw-output .commit.sha < $TMP_DIR/tag.json)
-	if test "$sha" != "$SHA" ; then
-	    cat $TMP_DIR/tag.json
-	    echo "the tag SHA in the $REPO repository does not match the tag SHA that triggered the build: $SHA"
-	    false
-	fi
+    if api GET repos/$REPO/tags/"$TAG" > "$TMP_DIR"/tag.json ; then
+    local sha=$(jq --raw-output .commit.sha < "$TMP_DIR"/tag.json)
+    if test "$sha" != "$SHA" ; then
+        cat "$TMP_DIR"/tag.json
+        echo "the tag SHA in the $REPO repository does not match the tag SHA that triggered the build: $SHA"
+        false
+    fi
     else
-	api POST repos/$REPO/tags --data-raw '{"tag_name": "'$TAG'", "target": "'$SHA'"}'
+    api POST repos/$REPO/tags --data-raw '{"tag_name": "'"$TAG"'", "target": "'"$SHA"'"}'
     fi
 }
 
 upload_release() {
-    local assets=$(ls $RELEASE_DIR/* | sed -e 's/^/-a /')
+    # assets is defined as a list of arguments, where values may contain whitespace and need to be quoted like this -a "my file.txt" -a "file.txt".
+    # It is expanded using "${assets[@]}" which preserves the separation of arguments and not split whitespace containing values.
+    # For reference, see https://github.com/koalaman/shellcheck/wiki/SC2086#exceptions
+    local assets=()
+    for file in "$RELEASE_DIR"/*; do
+        assets=("${assets[@]}" -a "$file")
+    done
     if $PRERELEASE || echo "${TAG}" | grep -qi '\-rc' ; then
-        releasetype="--prerelease"
+        releaseType="--prerelease"
         echo "Uploading as Pre-Release"
     else
         echo "Uploading as Stable"
     fi
     ensure_tag
-    anchor=$(echo $TAG | sed -e 's/^v//' -e 's/[^a-zA-Z0-9]/-/g')
-    if ! $BIN_DIR/tea release create $assets --repo $REPO --note "$RELEASENOTES" --tag $TAG --title "$TITLE" --draft ${releasetype} >& $TMP_DIR/tea.log ; then
-        if grep --quiet 'Unknown API Error: 500' $TMP_DIR/tea.log && grep --quiet services/release/release.go:194 $TMP_DIR/tea.log ; then
+    if ! "$BIN_DIR"/tea release create "${assets[@]}" --repo $REPO --note "$RELEASENOTES" --tag "$TAG" --title "$TITLE" --draft ${releaseType} >& "$TMP_DIR"/tea.log ; then
+        if grep --quiet 'Unknown API Error: 500' "$TMP_DIR"/tea.log && grep --quiet services/release/release.go:194 "$TMP_DIR"/tea.log ; then
             echo "workaround v1.20 race condition https://codeberg.org/forgejo/forgejo/issues/1370"
             sleep 10
-            $BIN_DIR/tea release create $assets --repo $REPO --note "$RELEASENOTES" --tag $TAG --title "$TITLE" --draft ${releasetype}
+            "$BIN_DIR"/tea release create "${assets[@]}" --repo $REPO --note "$RELEASENOTES" --tag "$TAG" --title "$TITLE" --draft ${releaseType}
         else
-            cat $TMP_DIR/tea.log
+            cat "$TMP_DIR"/tea.log
             return 1
         fi
     fi
@@ -69,52 +74,52 @@ upload_release() {
 release_draft() {
     local state="$1"
 
-    local id=$(api GET repos/$REPO/releases/tags/$TAG | jq --raw-output .id)
+    local id=$(api GET repos/$REPO/releases/tags/"$TAG" | jq --raw-output .id)
 
-    api PATCH repos/$REPO/releases/$id --data-raw '{"draft": '$state', "hide_archive_links": '$HIDE_ARCHIVE_LINK'}'
+    api PATCH repos/$REPO/releases/"$id" --data-raw '{"draft": '"$state"', "hide_archive_links": '$HIDE_ARCHIVE_LINK'}'
 }
 
 maybe_use_release_note_assistant() {
     if "$RELEASE_NOTES_ASSISTANT"; then
         curl --fail -s -S -o rna https://code.forgejo.org/forgejo/release-notes-assistant/releases/download/v1.2.3/release-notes-assistant
         chmod +x ./rna
-        ./rna --storage release --storage-location $TAG --forgejo-url $SCHEME://placeholder:$TOKEN@$HOST --repository $REPO --token $TOKEN release $TAG
+        ./rna --storage release --storage-location "$TAG" --forgejo-url "$SCHEME"://placeholder:"$TOKEN"@"$HOST" --repository $REPO --token "$TOKEN" release "$TAG"
     fi
 }
 
 sign_release() {
     local passphrase
     if test -s "$GPG_PASSPHRASE"; then
-	passphrase="--passphrase-file $GPG_PASSPHRASE"
+    passphrase="--passphrase-file $GPG_PASSPHRASE"
     fi
     gpg --import --no-tty --pinentry-mode loopback $passphrase "$GPG_PRIVATE_KEY"
-    for asset in $RELEASE_DIR/* ; do
-	if [[ $asset =~ .sha256$ ]] ; then
-	    continue
-	fi
-	gpg --armor --detach-sign --no-tty --pinentry-mode loopback $passphrase < $asset > $asset.asc
+    for asset in "$RELEASE_DIR"/* ; do
+    if [[ $asset =~ .sha256$ ]] ; then
+        continue
+    fi
+    gpg --armor --detach-sign --no-tty --pinentry-mode loopback $passphrase < "$asset" > "$asset".asc
     done
 }
 
 maybe_sign_release() {
     if test -s "$GPG_PRIVATE_KEY"; then
-	sign_release
+    sign_release
     fi
 }
 
 maybe_override() {
     if test "$OVERRIDE" = "false"; then
-	return
+    return
     fi
-    api DELETE repos/$REPO/releases/tags/$TAG >& /dev/null || true
-    api DELETE repos/$REPO/tags/$TAG >& /dev/null || true
+    api DELETE repos/$REPO/releases/tags/"$TAG" >& /dev/null || true
+    api DELETE repos/$REPO/tags/"$TAG" >& /dev/null || true
 }
 
 upload() {
     setup_api
     setup_tea
     rm -f ~/.config/tea/config.yml
-    GITEA_SERVER_TOKEN=$TOKEN $BIN_DIR/tea login add --url $FORGEJO
+    GITEA_SERVER_TOKEN=$TOKEN "$BIN_DIR"/tea login add --url $FORGEJO
     maybe_sign_release
     maybe_override
     upload_release
@@ -122,8 +127,8 @@ upload() {
 
 setup_api() {
     if ! which jq curl ; then
-	apt-get -qq update
-	apt-get install -y -qq jq curl
+    apt-get -qq update
+    apt-get install -y -qq jq curl
     fi
 }
 
@@ -133,46 +138,46 @@ api() {
     path=$1
     shift
 
-    curl --fail -X $method -sS -H "Content-Type: application/json" -H "Authorization: token $TOKEN" "$@" $FORGEJO/api/v1/$path
+    curl --fail -X "$method" -sS -H "Content-Type: application/json" -H "Authorization: token $TOKEN" "$@" $FORGEJO/api/v1/"$path"
 }
 
 wait_release() {
     local ready=false
     for i in $(seq $RETRY); do
-	if api GET repos/$REPO/releases/tags/$TAG | jq --raw-output .draft > $TMP_DIR/draft; then
-	    if test "$(cat $TMP_DIR/draft)" = "false"; then
-		ready=true
-		break
-	    fi
-	    echo "release $TAG is still a draft"
-	else
-	    echo "release $TAG does not exist yet"
-	fi
-	echo "waiting $DELAY seconds"
-	sleep $DELAY
+    if api GET repos/$REPO/releases/tags/"$TAG" | jq --raw-output .draft > "$TMP_DIR"/draft; then
+        if test "$(cat "$TMP_DIR"/draft)" = "false"; then
+        ready=true
+        break
+        fi
+        echo "release $TAG is still a draft"
+    else
+        echo "release $TAG does not exist yet"
+    fi
+    echo "waiting $DELAY seconds"
+    sleep $DELAY
     done
     if ! $ready ; then
-	echo "no release for $TAG"
-	return 1
+    echo "no release for $TAG"
+    return 1
     fi
 }
 
 download() {
     setup_api
     (
-	mkdir -p $RELEASE_DIR
-	cd $RELEASE_DIR
+    mkdir -p $RELEASE_DIR
+    cd $RELEASE_DIR
     if [[ ${DOWNLOAD_LATEST} == "true" ]] ; then
         echo "Downloading the latest release"
-        api GET repos/$REPO/releases/latest > $TMP_DIR/assets.json
+        api GET repos/$REPO/releases/latest > "$TMP_DIR"/assets.json
     elif [[ ${DOWNLOAD_LATEST} == "false" ]] ; then
         wait_release
         echo "Downloading tagged release ${TAG}"
-	    api GET repos/$REPO/releases/tags/$TAG > $TMP_DIR/assets.json
+        api GET repos/$REPO/releases/tags/"$TAG" > "$TMP_DIR"/assets.json
     fi
-	jq --raw-output '.assets[] | "\(.name) \(.browser_download_url)"' < $TMP_DIR/assets.json | while read name url ; do
-	    curl --fail -H "Authorization: token $TOKEN" -o $name -L $url
-	done
+     jq --raw-output '.assets[] | "\(.browser_download_url) \(.name)"' < "$TMP_DIR"/assets.json | while read url name  ; do  # `name` may contain whitespace, therefore, it must be last
+       curl --fail -H "Authorization: token $TOKEN" -o "$name" -L "$url"
+     done
     )
 }
 
diff --git a/testdata/upload-download/upload-dir/file 3.txt b/testdata/upload-download/upload-dir/file 3.txt
new file mode 100644
index 0000000..9eeba5f
--- /dev/null
+++ b/testdata/upload-download/upload-dir/file 3.txt	
@@ -0,0 +1 @@
+FILE3

From 410b4538718f158950cc35b31f2a55c7961bf062 Mon Sep 17 00:00:00 2001
From: Renovate Bot <bot@kriese.eu>
Date: Tue, 10 Dec 2024 00:02:00 +0000
Subject: [PATCH 03/14] Replace actions/setup-forgejo action with
 actions/setup-forgejo v1.0.1

---
 testdata/nested-upload-download/.forgejo/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testdata/nested-upload-download/.forgejo/workflows/test.yml b/testdata/nested-upload-download/.forgejo/workflows/test.yml
index 4c6bd91..e315714 100644
--- a/testdata/nested-upload-download/.forgejo/workflows/test.yml
+++ b/testdata/nested-upload-download/.forgejo/workflows/test.yml
@@ -12,7 +12,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - id: forgejo
-        uses: https://code.forgejo.org/actions/setup-forgejo@v1
+        uses: https://code.forgejo.org/actions/setup-forgejo@v1.0.1
         with:
           user: testuser
           password: admin1234

From 9d4ddfbaadf2ac8f162dba4bf2ee9b3d0296ddb3 Mon Sep 17 00:00:00 2001
From: limiting-factor <limiting-factor@posteo.com>
Date: Sun, 23 Feb 2025 15:30:06 +0100
Subject: [PATCH 04/14] chore(editorconfig): comply with .editorconfig

---
 forgejo-release.sh               | 108 +++++++++++++++----------------
 testdata/forgejo-release-test.sh |  13 ++--
 2 files changed, 61 insertions(+), 60 deletions(-)

diff --git a/forgejo-release.sh b/forgejo-release.sh
index 8abb54e..20d5221 100755
--- a/forgejo-release.sh
+++ b/forgejo-release.sh
@@ -22,23 +22,23 @@ if ${VERBOSE:-false}; then set -x; fi
 export GNUPGHOME
 
 setup_tea() {
-    if ! test -f "$BIN_DIR"/tea ; then
-    ARCH=$(dpkg --print-architecture)
-    curl -sL https://dl.gitea.io/tea/$TEA_VERSION/tea-$TEA_VERSION-linux-"$ARCH" > "$BIN_DIR"/tea
-    chmod +x "$BIN_DIR"/tea
+    if ! test -f "$BIN_DIR"/tea; then
+        ARCH=$(dpkg --print-architecture)
+        curl -sL https://dl.gitea.io/tea/$TEA_VERSION/tea-$TEA_VERSION-linux-"$ARCH" >"$BIN_DIR"/tea
+        chmod +x "$BIN_DIR"/tea
     fi
 }
 
 ensure_tag() {
-    if api GET repos/$REPO/tags/"$TAG" > "$TMP_DIR"/tag.json ; then
-    local sha=$(jq --raw-output .commit.sha < "$TMP_DIR"/tag.json)
-    if test "$sha" != "$SHA" ; then
-        cat "$TMP_DIR"/tag.json
-        echo "the tag SHA in the $REPO repository does not match the tag SHA that triggered the build: $SHA"
-        false
-    fi
+    if api GET repos/$REPO/tags/"$TAG" >"$TMP_DIR"/tag.json; then
+        local sha=$(jq --raw-output .commit.sha <"$TMP_DIR"/tag.json)
+        if test "$sha" != "$SHA"; then
+            cat "$TMP_DIR"/tag.json
+            echo "the tag SHA in the $REPO repository does not match the tag SHA that triggered the build: $SHA"
+            false
+        fi
     else
-    api POST repos/$REPO/tags --data-raw '{"tag_name": "'"$TAG"'", "target": "'"$SHA"'"}'
+        api POST repos/$REPO/tags --data-raw '{"tag_name": "'"$TAG"'", "target": "'"$SHA"'"}'
     fi
 }
 
@@ -50,15 +50,15 @@ upload_release() {
     for file in "$RELEASE_DIR"/*; do
         assets=("${assets[@]}" -a "$file")
     done
-    if $PRERELEASE || echo "${TAG}" | grep -qi '\-rc' ; then
+    if $PRERELEASE || echo "${TAG}" | grep -qi '\-rc'; then
         releaseType="--prerelease"
         echo "Uploading as Pre-Release"
     else
         echo "Uploading as Stable"
     fi
     ensure_tag
-    if ! "$BIN_DIR"/tea release create "${assets[@]}" --repo $REPO --note "$RELEASENOTES" --tag "$TAG" --title "$TITLE" --draft ${releaseType} >& "$TMP_DIR"/tea.log ; then
-        if grep --quiet 'Unknown API Error: 500' "$TMP_DIR"/tea.log && grep --quiet services/release/release.go:194 "$TMP_DIR"/tea.log ; then
+    if ! "$BIN_DIR"/tea release create "${assets[@]}" --repo $REPO --note "$RELEASENOTES" --tag "$TAG" --title "$TITLE" --draft ${releaseType} >&"$TMP_DIR"/tea.log; then
+        if grep --quiet 'Unknown API Error: 500' "$TMP_DIR"/tea.log && grep --quiet services/release/release.go:194 "$TMP_DIR"/tea.log; then
             echo "workaround v1.20 race condition https://codeberg.org/forgejo/forgejo/issues/1370"
             sleep 10
             "$BIN_DIR"/tea release create "${assets[@]}" --repo $REPO --note "$RELEASENOTES" --tag "$TAG" --title "$TITLE" --draft ${releaseType}
@@ -90,29 +90,29 @@ maybe_use_release_note_assistant() {
 sign_release() {
     local passphrase
     if test -s "$GPG_PASSPHRASE"; then
-    passphrase="--passphrase-file $GPG_PASSPHRASE"
+        passphrase="--passphrase-file $GPG_PASSPHRASE"
     fi
     gpg --import --no-tty --pinentry-mode loopback $passphrase "$GPG_PRIVATE_KEY"
-    for asset in "$RELEASE_DIR"/* ; do
-    if [[ $asset =~ .sha256$ ]] ; then
-        continue
-    fi
-    gpg --armor --detach-sign --no-tty --pinentry-mode loopback $passphrase < "$asset" > "$asset".asc
+    for asset in "$RELEASE_DIR"/*; do
+        if [[ $asset =~ .sha256$ ]]; then
+            continue
+        fi
+        gpg --armor --detach-sign --no-tty --pinentry-mode loopback $passphrase <"$asset" >"$asset".asc
     done
 }
 
 maybe_sign_release() {
     if test -s "$GPG_PRIVATE_KEY"; then
-    sign_release
+        sign_release
     fi
 }
 
 maybe_override() {
     if test "$OVERRIDE" = "false"; then
-    return
+        return
     fi
-    api DELETE repos/$REPO/releases/tags/"$TAG" >& /dev/null || true
-    api DELETE repos/$REPO/tags/"$TAG" >& /dev/null || true
+    api DELETE repos/$REPO/releases/tags/"$TAG" >&/dev/null || true
+    api DELETE repos/$REPO/tags/"$TAG" >&/dev/null || true
 }
 
 upload() {
@@ -126,9 +126,9 @@ upload() {
 }
 
 setup_api() {
-    if ! which jq curl ; then
-    apt-get -qq update
-    apt-get install -y -qq jq curl
+    if ! which jq curl; then
+        apt-get -qq update
+        apt-get install -y -qq jq curl
     fi
 }
 
@@ -144,40 +144,40 @@ api() {
 wait_release() {
     local ready=false
     for i in $(seq $RETRY); do
-    if api GET repos/$REPO/releases/tags/"$TAG" | jq --raw-output .draft > "$TMP_DIR"/draft; then
-        if test "$(cat "$TMP_DIR"/draft)" = "false"; then
-        ready=true
-        break
+        if api GET repos/$REPO/releases/tags/"$TAG" | jq --raw-output .draft >"$TMP_DIR"/draft; then
+            if test "$(cat "$TMP_DIR"/draft)" = "false"; then
+                ready=true
+                break
+            fi
+            echo "release $TAG is still a draft"
+        else
+            echo "release $TAG does not exist yet"
         fi
-        echo "release $TAG is still a draft"
-    else
-        echo "release $TAG does not exist yet"
-    fi
-    echo "waiting $DELAY seconds"
-    sleep $DELAY
+        echo "waiting $DELAY seconds"
+        sleep $DELAY
     done
-    if ! $ready ; then
-    echo "no release for $TAG"
-    return 1
+    if ! $ready; then
+        echo "no release for $TAG"
+        return 1
     fi
 }
 
 download() {
     setup_api
     (
-    mkdir -p $RELEASE_DIR
-    cd $RELEASE_DIR
-    if [[ ${DOWNLOAD_LATEST} == "true" ]] ; then
-        echo "Downloading the latest release"
-        api GET repos/$REPO/releases/latest > "$TMP_DIR"/assets.json
-    elif [[ ${DOWNLOAD_LATEST} == "false" ]] ; then
-        wait_release
-        echo "Downloading tagged release ${TAG}"
-        api GET repos/$REPO/releases/tags/"$TAG" > "$TMP_DIR"/assets.json
-    fi
-     jq --raw-output '.assets[] | "\(.browser_download_url) \(.name)"' < "$TMP_DIR"/assets.json | while read url name  ; do  # `name` may contain whitespace, therefore, it must be last
-       curl --fail -H "Authorization: token $TOKEN" -o "$name" -L "$url"
-     done
+        mkdir -p $RELEASE_DIR
+        cd $RELEASE_DIR
+        if [[ ${DOWNLOAD_LATEST} == "true" ]]; then
+            echo "Downloading the latest release"
+            api GET repos/$REPO/releases/latest >"$TMP_DIR"/assets.json
+        elif [[ ${DOWNLOAD_LATEST} == "false" ]]; then
+            wait_release
+            echo "Downloading tagged release ${TAG}"
+            api GET repos/$REPO/releases/tags/"$TAG" >"$TMP_DIR"/assets.json
+        fi
+        jq --raw-output '.assets[] | "\(.browser_download_url) \(.name)"' <"$TMP_DIR"/assets.json | while read url name; do # `name` may contain whitespace, therefore, it must be last
+            curl --fail -H "Authorization: token $TOKEN" -o "$name" -L "$url"
+        done
     )
 }
 
diff --git a/testdata/forgejo-release-test.sh b/testdata/forgejo-release-test.sh
index 4e84498..4ff2eae 100755
--- a/testdata/forgejo-release-test.sh
+++ b/testdata/forgejo-release-test.sh
@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: MIT
 
 set -ex
+PS4='${BASH_SOURCE[0]}:$LINENO: ${FUNCNAME[0]}:  '
 
 test_teardown() {
     setup_api
@@ -44,16 +45,16 @@ test_ensure_tag() {
     # idempotent
     #
     ensure_tag
-    api GET repos/$REPO/tags/$TAG > $TMP_DIR/tag1.json
+    api GET repos/$REPO/tags/$TAG >$TMP_DIR/tag1.json
     ensure_tag
-    api GET repos/$REPO/tags/$TAG > $TMP_DIR/tag2.json
+    api GET repos/$REPO/tags/$TAG >$TMP_DIR/tag2.json
     diff -u $TMP_DIR/tag[12].json
     #
     # sanity check on the SHA of an existing tag
     #
     (
-	SHA=12345
-	! ensure_tag
+        SHA=12345
+        ! ensure_tag
     )
     api DELETE repos/$REPO/tags/$TAG
 }
@@ -94,8 +95,8 @@ test_maybe_sign_release_skipped() {
 }
 
 test_maybe_sign_release_verify() {
-    for file in  $RELEASE_DIR/file-one.txt  $RELEASE_DIR/file-two.txt; do
-	gpg --verify $file.asc $file
+    for file in $RELEASE_DIR/file-one.txt $RELEASE_DIR/file-two.txt; do
+        gpg --verify $file.asc $file
     done
 }
 

From 0079bcb471a6d260bb06ef51ff495ec1c6cdcc2f Mon Sep 17 00:00:00 2001
From: limiting-factor <limiting-factor@posteo.com>
Date: Sun, 23 Feb 2025 16:03:14 +0100
Subject: [PATCH 05/14] fix: override=true must not needlessly delete a tag

If the tag to be set is exactly the same as the tag that exists, do
not delete it.

When the tag is recreated although it is not necessary, it may trigger
workflows that have already been triggered and send the workflow in a
loop.

- split `get_tag` & `matched_tag` out of ensure_tag
- in case of an override, only delete the tag if it fails `matched_tag`
- trace shell lines to help debug
- add testing
---
 forgejo-release.sh               | 37 ++++++++++++++++++++++++++------
 testdata/forgejo-release-test.sh |  7 ++++--
 2 files changed, 35 insertions(+), 9 deletions(-)

diff --git a/forgejo-release.sh b/forgejo-release.sh
index 20d5221..1474b6a 100755
--- a/forgejo-release.sh
+++ b/forgejo-release.sh
@@ -19,6 +19,8 @@ if ${VERBOSE:-false}; then set -x; fi
 : ${RETRY:=1}
 : ${DELAY:=10}
 
+TAG_FILE="$TMP_DIR/tag$$.json"
+
 export GNUPGHOME
 
 setup_tea() {
@@ -29,16 +31,35 @@ setup_tea() {
     fi
 }
 
+get_tag() {
+    if ! test -f "$TAG_FILE"; then
+        if api GET repos/$REPO/tags/"$TAG" >"$TAG_FILE"; then
+            echo "tag $TAG exists"
+        else
+            echo "tag $TAG does not exists"
+        fi
+    fi
+    test -s "$TAG_FILE"
+}
+
+matched_tag() {
+    if get_tag; then
+        local sha=$(jq --raw-output .commit.sha <"$TAG_FILE")
+        test "$sha" = "$SHA"
+    else
+        return 1
+    fi
+}
+
 ensure_tag() {
-    if api GET repos/$REPO/tags/"$TAG" >"$TMP_DIR"/tag.json; then
-        local sha=$(jq --raw-output .commit.sha <"$TMP_DIR"/tag.json)
-        if test "$sha" != "$SHA"; then
-            cat "$TMP_DIR"/tag.json
+    if get_tag; then
+        if ! matched_tag; then
+            cat "$TAG_FILE"
             echo "the tag SHA in the $REPO repository does not match the tag SHA that triggered the build: $SHA"
-            false
+            return 1
         fi
     else
-        api POST repos/$REPO/tags --data-raw '{"tag_name": "'"$TAG"'", "target": "'"$SHA"'"}'
+        api POST repos/$REPO/tags --data-raw '{"tag_name": "'"$TAG"'", "target": "'"$SHA"'"}' >"$TAG_FILE"
     fi
 }
 
@@ -112,7 +133,9 @@ maybe_override() {
         return
     fi
     api DELETE repos/$REPO/releases/tags/"$TAG" >&/dev/null || true
-    api DELETE repos/$REPO/tags/"$TAG" >&/dev/null || true
+    if get_tag && ! matched_tag; then
+        api DELETE repos/$REPO/tags/"$TAG"
+    fi
 }
 
 upload() {
diff --git a/testdata/forgejo-release-test.sh b/testdata/forgejo-release-test.sh
index 4ff2eae..97f630c 100755
--- a/testdata/forgejo-release-test.sh
+++ b/testdata/forgejo-release-test.sh
@@ -45,15 +45,18 @@ test_ensure_tag() {
     # idempotent
     #
     ensure_tag
-    api GET repos/$REPO/tags/$TAG >$TMP_DIR/tag1.json
+    mv $TAG_FILE $TMP_DIR/tag1.json
+
     ensure_tag
-    api GET repos/$REPO/tags/$TAG >$TMP_DIR/tag2.json
+    mv $TAG_FILE $TMP_DIR/tag2.json
+
     diff -u $TMP_DIR/tag[12].json
     #
     # sanity check on the SHA of an existing tag
     #
     (
         SHA=12345
+        ! matched_tag
         ! ensure_tag
     )
     api DELETE repos/$REPO/tags/$TAG

From 1a6975277b5923076d09802bc6c5fd32c38bf70a Mon Sep 17 00:00:00 2001
From: limiting-factor <limiting-factor@posteo.com>
Date: Sun, 23 Feb 2025 23:49:15 +0100
Subject: [PATCH 06/14] fix: the tag cache must be deleted when the tag is
 deleted

Otherwise it will linger and potentially create problem when
using overrides.
---
 forgejo-release.sh               | 15 +++++++++++++--
 testdata/forgejo-release-test.sh | 15 +++++++++++++--
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/forgejo-release.sh b/forgejo-release.sh
index 1474b6a..38aa100 100755
--- a/forgejo-release.sh
+++ b/forgejo-release.sh
@@ -59,7 +59,18 @@ ensure_tag() {
             return 1
         fi
     else
-        api POST repos/$REPO/tags --data-raw '{"tag_name": "'"$TAG"'", "target": "'"$SHA"'"}' >"$TAG_FILE"
+        create_tag
+    fi
+}
+
+create_tag() {
+    api POST repos/$REPO/tags --data-raw '{"tag_name": "'"$TAG"'", "target": "'"$SHA"'"}' >"$TAG_FILE"
+}
+
+delete_tag() {
+    if get_tag; then
+        api DELETE repos/$REPO/tags/$TAG
+        rm -f "$TAG_FILE"
     fi
 }
 
@@ -134,7 +145,7 @@ maybe_override() {
     fi
     api DELETE repos/$REPO/releases/tags/"$TAG" >&/dev/null || true
     if get_tag && ! matched_tag; then
-        api DELETE repos/$REPO/tags/"$TAG"
+        delete_tag
     fi
 }
 
diff --git a/testdata/forgejo-release-test.sh b/testdata/forgejo-release-test.sh
index 97f630c..156fb6b 100755
--- a/testdata/forgejo-release-test.sh
+++ b/testdata/forgejo-release-test.sh
@@ -39,8 +39,18 @@ test_wait_release() {
     ! wait_release
 }
 
+test_create_delete_tag() {
+    delete_tag
+
+    ! get_tag
+    create_tag
+    get_tag
+    delete_tag
+    ! get_tag
+}
+
 test_ensure_tag() {
-    api DELETE repos/$REPO/tags/$TAG || true
+    delete_tag
     #
     # idempotent
     #
@@ -59,7 +69,7 @@ test_ensure_tag() {
         ! matched_tag
         ! ensure_tag
     )
-    api DELETE repos/$REPO/tags/$TAG
+    delete_tag
 }
 
 test_maybe_sign_release_no_gpg() {
@@ -133,6 +143,7 @@ test_run() {
     REPO=$user/$project
     test_setup $project
     test_ensure_tag
+    test_create_delete_tag
     DELAY=0
     test_wait_release_fail
     echo "================================ TEST BEGIN"

From a6e3fdb19e717c1541300e0db39f14f22d03fa19 Mon Sep 17 00:00:00 2001
From: dorianim <dorianim@noreply.code.forgejo.org>
Date: Mon, 7 Apr 2025 06:35:43 +0000
Subject: [PATCH 07/14] feat: add default token and document default values
 (#44)

This PR adds `${{ secrets.GITHUB_TOKEN }}` as the default value for the token and documents all default values in the readme.
Fixes #43

Co-authored-by: Dorian Zedler <dorian@itsblue.de>
Reviewed-on: https://code.forgejo.org/actions/forgejo-release/pulls/44
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: dorianim <dorianim@noreply.code.forgejo.org>
Co-committed-by: dorianim <dorianim@noreply.code.forgejo.org>
---
 README.md  | 10 +++++-----
 action.yml | 21 +++++----------------
 2 files changed, 10 insertions(+), 21 deletions(-)

diff --git a/README.md b/README.md
index eb93cf2..3a52c29 100644
--- a/README.md
+++ b/README.md
@@ -10,12 +10,12 @@ Upload or download the assets of a release to a Forgejo instance.
 
 | name | description | required | default |
 | --- | --- | --- | --- |
-| `url` | <p>URL of the Forgejo instance</p> | `false` | `""` |
-| `repo` | <p>owner/project relative to the URL</p> | `false` | `""` |
-| `tag` | <p>Tag of the release</p> | `false` | `""` |
+| `url` | <p>URL of the Forgejo instance</p> | `false` | `${{ env.GITHUB_SERVER_URL }}` |
+| `repo` | <p>owner/project relative to the URL</p> | `false` | `${{ github.repository }}` |
+| `tag` | <p>Tag of the release</p> | `false` | `${{ github.ref_name }}` |
 | `title` | <p>Title of the release (defaults to tag)</p> | `false` | `""` |
-| `sha` | <p>SHA of the release</p> | `false` | `""` |
-| `token` | <p>Forgejo application token</p> | `true` | `""` |
+| `sha` | <p>SHA of the release</p> | `false` | `${{ github.sha }}` |
+| `token` | <p>Forgejo application token</p> | `false` | `${{ secrets.GITHUB_TOKEN }}` |
 | `release-dir` | <p>Directory in whichs release assets are uploaded or downloaded</p> | `true` | `""` |
 | `release-notes` | <p>Release notes</p> | `false` | `""` |
 | `direction` | <p>Can either be <code>download</code> or <code>upload</code></p> | `true` | `""` |
diff --git a/action.yml b/action.yml
index 847c886..7e09788 100644
--- a/action.yml
+++ b/action.yml
@@ -6,17 +6,21 @@ description: |
 inputs:
   url:
     description: 'URL of the Forgejo instance'
+    default: '${{ env.GITHUB_SERVER_URL }}'
   repo:
     description: 'owner/project relative to the URL'
+    default: '${{ github.repository }}'
   tag:
     description: 'Tag of the release'
+    default: '${{ github.ref_name }}'
   title:
     description: 'Title of the release (defaults to tag)'
   sha:
     description: 'SHA of the release'
+    default: '${{ github.sha }}'
   token:
     description: 'Forgejo application token'
-    required: true
+    default: '${{ secrets.GITHUB_TOKEN }}'
   release-dir:
     description: 'Directory in whichs release assets are uploaded or downloaded'
     required: true
@@ -57,9 +61,6 @@ runs:
       shell: bash
     - run: |
         export FORGEJO="${{ inputs.url }}"
-        if test -z "$FORGEJO"; then
-          export FORGEJO="${{ env.GITHUB_SERVER_URL }}"
-        fi
         # A trailing / will mean http://forgejo//api/v1 is used
         # and it always 401 as of v1.19, because of the double slash
         FORGEJO=${FORGEJO%%/}
@@ -67,17 +68,8 @@ runs:
         export HOST=${FORGEJO#*://}
 
         export REPO="${{ inputs.repo }}"
-        if test -z "$REPO"; then
-          export REPO="${{ github.repository }}"
-        fi
 
         export TAG="${{ inputs.tag }}"
-        if test -z "$TAG"; then
-          export TAG="${{ github.ref_name }}"
-          # until https://code.forgejo.org/forgejo/runner/issues/9 is fixed
-          # trim refs/tags/
-          TAG=${TAG##refs/tags/}
-        fi
 
         export TITLE="${{ inputs.title }}"
 
@@ -99,9 +91,6 @@ runs:
         )
 
         export SHA="${{ inputs.sha }}"
-        if test -z "$SHA"; then
-          export SHA="${{ github.sha }}"
-        fi
 
         export OVERRIDE="${{ inputs.override }}"
 

From a198449381c1c8feb1e0f1b63a2a23a7b9283a92 Mon Sep 17 00:00:00 2001
From: Earl Warren <contact@earl-warren.org>
Date: Sat, 12 Apr 2025 13:20:25 +0200
Subject: [PATCH 08/14] chore: update the example to refer to v2.6.0

and be explicit about the parameters to improve readability
---
 README.md | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/README.md b/README.md
index 3a52c29..f532c6b 100644
--- a/README.md
+++ b/README.md
@@ -37,16 +37,18 @@ Upload or download the assets of a release to a Forgejo instance.
 Upload the release located in `release-dir` to the release section of a repository (`url` and `repo`):
 
 ```yaml
-on: [tag]
 jobs:
   upload-release:
-    runs-on: ubuntu-latest
+    runs-on: docker
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/forgejo-release@v2
+      - uses: actions/checkout@v4
+      - uses: actions/forgejo-release@v2.6.0
         with:
           direction: upload
-          url: https://code.forgejo.org
+          url: https://my-forgejo-instance.net
+          repo: myuser/myrepo
+          token: ${{ secrets.WRITE_TOKEN_TO_MYREPO }}
+          tag: v1.0.0
           release-dir: dist/release
           release-notes: "MY RELEASE NOTES"
 ```
@@ -56,24 +58,24 @@ jobs:
 Example downloading the forgejo release v1.21.4-0 into the working directory:
 
 ```yaml
-on: [tag]
 jobs:
   download-release:
-    runs-on: ubuntu-latest
+    runs-on: docker
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/forgejo-release@v2
+      - uses: actions/checkout@v4
+      - uses: actions/forgejo-release@v2.6.0
         with:
           direction: download
-          url: https://code.forgejo.org
-          repo: forgejo/forgejo
-          tag: v1.21.4-0
+          url: https://my-forgejo-instance.net
+          repo: myuser/myrepo
+          token: ${{ secrets.READ_TOKEN_TO_MYREPO }}
+          tag: v1.0.0
           release-dir: ./  # by default, files are downloaded into dist/release
 ```
 
 ### Real world example
 
-This action is used to [publish](https://code.forgejo.org/forgejo/release-notes-assistant/src/branch/main/.forgejo/workflows/release.yml) the release notes assistant assets.
+This action is used to [publish](https://code.forgejo.org/forgejo/release-notes-assistant/src/commit/09f2c22d80d5ee655783cfeb2c1d4bab4afec3e4/.forgejo/workflows/release.yml) the release notes assistant assets.
 
 ## Update the `input` section of the README
 

From dccbd17bd860737c9cdebd1d081a7c81d31b40e4 Mon Sep 17 00:00:00 2001
From: Earl Warren <contact@earl-warren.org>
Date: Sat, 12 Apr 2025 13:33:43 +0200
Subject: [PATCH 09/14] chore: teach renovate to update the example version

---
 renovate.json | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/renovate.json b/renovate.json
index e95bd65..b676ef6 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,6 +1,18 @@
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "local>actions/renovate-config"
-  ]
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": ["local>actions/renovate-config"],
+    "customManagers": [
+        {
+            "customType": "regex",
+            "description": "update example in README.md",
+            "fileMatch": ["^README.md$"],
+            "matchStrings": [
+                "uses: actions/forgejo-release@(?<currentValue>v\\d+\\.\\d+\\.\\d+)"
+            ],
+            "datasourceTemplate": "gitea-tags",
+            "depNameTemplate": "actions/forgejo-release",
+            "versioningTemplate": "semver",
+            "registryUrlTemplate": "https://code.forgejo.org"
+        }
+    ]
 }

From 13b5920f54ce5beece8ce6fe91467eabb0bebd04 Mon Sep 17 00:00:00 2001
From: Renovate Bot <bot@kriese.eu>
Date: Sun, 13 Apr 2025 08:31:08 +0000
Subject: [PATCH 10/14] Update actions/checkout action to v4

---
 .forgejo/workflows/integration.yml                              | 2 +-
 .forgejo/workflows/tests.yml                                    | 2 +-
 testdata/nested-upload-download/.forgejo/workflows/test.yml     | 2 +-
 .../upload-download/.forgejo/workflows/gpg-no-passphrase.yml    | 2 +-
 testdata/upload-download/.forgejo/workflows/gpg.yml             | 2 +-
 testdata/upload-download/.forgejo/workflows/test.yml            | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.forgejo/workflows/integration.yml b/.forgejo/workflows/integration.yml
index ced0ae6..a464283 100644
--- a/.forgejo/workflows/integration.yml
+++ b/.forgejo/workflows/integration.yml
@@ -3,7 +3,7 @@ jobs:
   integration:
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - id: forgejo
         uses: https://code.forgejo.org/actions/setup-forgejo@v2.0.4
diff --git a/.forgejo/workflows/tests.yml b/.forgejo/workflows/tests.yml
index 70a5f87..5eba0cc 100644
--- a/.forgejo/workflows/tests.yml
+++ b/.forgejo/workflows/tests.yml
@@ -3,7 +3,7 @@ jobs:
   integration:
     runs-on: docker
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Unit tests of the supporting script forgejo-release.sh
         run: |
diff --git a/testdata/nested-upload-download/.forgejo/workflows/test.yml b/testdata/nested-upload-download/.forgejo/workflows/test.yml
index e315714..06ec275 100644
--- a/testdata/nested-upload-download/.forgejo/workflows/test.yml
+++ b/testdata/nested-upload-download/.forgejo/workflows/test.yml
@@ -10,7 +10,7 @@ jobs:
   setup-forgejo:
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - id: forgejo
         uses: https://code.forgejo.org/actions/setup-forgejo@v1.0.1
         with:
diff --git a/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml b/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml
index 8679fc5..db74ade 100644
--- a/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml
+++ b/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml
@@ -90,7 +90,7 @@ jobs:
   upload-gpg-no-passphrase:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-upload
         uses: SELF@vTest
diff --git a/testdata/upload-download/.forgejo/workflows/gpg.yml b/testdata/upload-download/.forgejo/workflows/gpg.yml
index 8eb043e..49475d1 100644
--- a/testdata/upload-download/.forgejo/workflows/gpg.yml
+++ b/testdata/upload-download/.forgejo/workflows/gpg.yml
@@ -93,7 +93,7 @@ jobs:
   upload-gpg:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-upload
         uses: SELF@vTest
diff --git a/testdata/upload-download/.forgejo/workflows/test.yml b/testdata/upload-download/.forgejo/workflows/test.yml
index a88867a..f2bbe6f 100644
--- a/testdata/upload-download/.forgejo/workflows/test.yml
+++ b/testdata/upload-download/.forgejo/workflows/test.yml
@@ -6,7 +6,7 @@ jobs:
   upload-download:
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-upload
         uses: SELF@vTest

From f0a9704521e65840e818ab30cbc842540f671c1f Mon Sep 17 00:00:00 2001
From: Renovate Bot <bot@kriese.eu>
Date: Sun, 13 Apr 2025 08:31:13 +0000
Subject: [PATCH 11/14] Update https://code.forgejo.org/actions/setup-forgejo
 action to v2.0.11

---
 .forgejo/workflows/integration.yml                          | 2 +-
 testdata/nested-upload-download/.forgejo/workflows/test.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/integration.yml b/.forgejo/workflows/integration.yml
index ced0ae6..343fa7b 100644
--- a/.forgejo/workflows/integration.yml
+++ b/.forgejo/workflows/integration.yml
@@ -6,7 +6,7 @@ jobs:
       - uses: actions/checkout@v3
 
       - id: forgejo
-        uses: https://code.forgejo.org/actions/setup-forgejo@v2.0.4
+        uses: https://code.forgejo.org/actions/setup-forgejo@v2.0.11
         with:
           user: testuser
           password: admin1234
diff --git a/testdata/nested-upload-download/.forgejo/workflows/test.yml b/testdata/nested-upload-download/.forgejo/workflows/test.yml
index e315714..293fa40 100644
--- a/testdata/nested-upload-download/.forgejo/workflows/test.yml
+++ b/testdata/nested-upload-download/.forgejo/workflows/test.yml
@@ -12,7 +12,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - id: forgejo
-        uses: https://code.forgejo.org/actions/setup-forgejo@v1.0.1
+        uses: https://code.forgejo.org/actions/setup-forgejo@v2.0.11
         with:
           user: testuser
           password: admin1234

From cf13c2cb1d8a5dc0dad55a865a4b62346c5f7b01 Mon Sep 17 00:00:00 2001
From: Renovate Bot <bot@kriese.eu>
Date: Mon, 5 May 2025 01:03:45 +0000
Subject: [PATCH 12/14] Migrate config renovate.json

---
 renovate.json | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/renovate.json b/renovate.json
index b676ef6..1fd35ff 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,11 +1,15 @@
 {
     "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-    "extends": ["local>actions/renovate-config"],
+    "extends": [
+        "local>actions/renovate-config"
+    ],
     "customManagers": [
         {
             "customType": "regex",
             "description": "update example in README.md",
-            "fileMatch": ["^README.md$"],
+            "managerFilePatterns": [
+                "/^README.md$/"
+            ],
             "matchStrings": [
                 "uses: actions/forgejo-release@(?<currentValue>v\\d+\\.\\d+\\.\\d+)"
             ],

From d555422510fbfe9a1b4722f3ea2ddf8a31c5b19f Mon Sep 17 00:00:00 2001
From: Earl Warren <contact@earl-warren.org>
Date: Fri, 27 Jun 2025 14:58:45 +0200
Subject: [PATCH 13/14] fix: private GPG key used in CI expired May 2025

Renew them.
---
 testdata/gpg-private-no-passphrase.asc        | 156 ++++++++--------
 testdata/gpg-private.asc                      |  94 ++--------
 .../.forgejo/workflows/gpg-no-passphrase.yml  | 166 +++++++++---------
 .../.forgejo/workflows/gpg.yml                | 100 ++---------
 4 files changed, 193 insertions(+), 323 deletions(-)

diff --git a/testdata/gpg-private-no-passphrase.asc b/testdata/gpg-private-no-passphrase.asc
index 41607a6..5adeb64 100644
--- a/testdata/gpg-private-no-passphrase.asc
+++ b/testdata/gpg-private-no-passphrase.asc
@@ -1,81 +1,81 @@
 -----BEGIN PGP PRIVATE KEY BLOCK-----
 
-lQVYBGRwcNcBDADUZUxCbjw0hOtMaLIYhEbgYFR2Oyxz8IDJTVALuLGQbHnLM6La
-IVxGwk9CgxX8vP9pN3Fy+uX+KInV41bLGd30qPDvqCuAbAo4bAT0Sg/fN3A7fuSX
-KfUStJbY3OyQZQbHWxOpsyIziIqBMXipgFQD/IncRMhWjcQh4znnkUb+e3oj1/f1
-9eErwfgsiDsj7M/FSWolrwttd2VQah+WumhVFjvb+M4j5zI9UBNGNsVCTxQXTN5L
-MtPJuypuMzawmTvUNm7470VDgO/dCWGlZ7gshoNd2fNnFCMgTSWYu9C8zFCkFOi2
-ZiwmIQTu3QBDNXaqR7r9j1s9q4hrloEZwmTFXV+PvEczUXx+8Scq8ONZGJdjo6NL
-mp1fM5//o3Vfl0oJsQf2WS/bpyJQDZEQaKGekHJ5W4OuH9+mzDfqkkpTl/aduVN7
-uXF4AYfdZMOqNjkNpi3RAh54LKVtqaeVRzypAnjn8Vb2WHw7tQX9S4DDUtul9Pyx
-a6xqLdtJYw/PwaUAEQEAAQAL/2HSZdUSwFfQAC8o6R2xjpM4yq3JgyfC1Q3htcQw
-RFeoHlAgcBjW1JEiXS7dAPtucJQdHPs/4z2znggMtKTGPRu5034NjjuPhwWFeqKo
-mbbM6bv9LXsRr/X1hqRK3AmE/iJDKEM4ZcAmWuQ1zMUEfa14WmZAp6R1lqek575n
-grMiW5a2mVWG8TYeGBcqh1J8dxT+Qw0oGbNJEjh/KB1brUHDA77EUOzoRpNGlhn4
-j9GCalZw6NDpj/GRanFm1QFxEO5NPi5wnwzlM1+PU7jva3aHQFr8pQbgVv0bBEcR
-5Dsj1vB/+Dwv1sgSUs3qfjnWnbcpY3+j4TTRWwJTtEufqSPtZSu3/o2K3NenaQGu
-pbeDRHWMxrfIfUe65uOFgsgO5gBL0NjIh6D0pDYJUSzcxP7oPTMjBHcfjyxAjJrj
-YNlVyrHlKGMUNbjhodBS+5y5A5ugIi9N0W2DjFMFug296foGIBoVuVpqiiEJls4d
-FedKD9fhFvYh2BwqvYdQpexk4QYA5Firzcgr0By2OffnfbcxjzJR4wlHafKdTIag
-bcPYpaOJKKfchHPAIzQ++HZ147qAabpcwENL1uEz4gRpVlr4JPkcOABsSl6xezm2
-QxWTEmnrzUvmyspD858rBCGAv7/sUhP5Bj6fL4wr+N1qLu5F7Wy96yJSVn9EA5om
-q2MhfMcvgV/mjtiLjCWdyuJjFJ1vqXVg2I/yXoNmPNO6f1JpjwcZjd/140WcCIvm
-VjWHlHEgfnAZkxoBfNhvofeDqQn7BgDuHh1Ph+AjXBSvmQPA7+3DxvAe5zK1xkgs
-PEwFH6I3hfz6uQizENyTgUYP721/8Iz3jXsz8GMOJ+XGLA6tUav37mW7xP7kQTU/
-QNUt8v+eEL+Yo5/3oHjD63P6YnzAzWiUhPYziRcSUeCbD0BFtepIVXkFo3M0/U5k
-KjB/KtpuinNRaOBE6NRwyJ83cneFNKLy2Tlmf98yhSKAiuiCpzS9KVtqKrnjv7ho
-uyOoi6jyXAFLm48gR6QF8HHPmmNDMN8F+wTJgOOir8Q6FOSSLlLXbgakZnUf33j9
-7Vqn/PnFTLUmV7rmJUgfB/nHogN19ibYs2Dnfi/EC5suqqf6qr77JZD1UVZE2Zrm
-5F4AXy8ZIm0yVO/bODZ+h6PnFI/9v/8FsxAMD8Ksrte6KtLLfhbZ7xQkroSazc0q
-rAgpq6NmLtreurjSA7/yZwZ5dZq/FdEi33GQ6RtGXUTW5sblk4D/r03BkwPFr9WW
-30YpLhPFoWvJyXlEGJaUMmpJxdHcRNCPE+bDtBxUZXN0IFVzZXIgPHRlc3RAZXhh
-bXBsZS5jb20+iQHUBBMBCgA+FiEEANPZ7fb3VHPWC0w3UsTUTh9UzVQFAmRwcNcC
-GwMFCQPCZwAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQUsTUTh9UzVTbWgwA
-t0Wlo052dkF44Tq+AWn7C1duxNd8Tf8jNDkat5O1OgNL0JfXaklwAFUhf3QaWvxn
-SbtEMTryhVyW/YA2mICuilBeATLycA1ch91pKr0W3P+8pWLnAKyjCnxY1JkgypDs
-TgnBwlW1bt27qpKxlEv/UN786DGsYsWCy1j+X8k7ayO5WWjVkwfmQc/C57dv0Mxy
-ONBwLyIuYBoQ6pfzCXu3aBBaXy1dYZ4FYF4BBnyfftt3obIJo/rrXPD7aBvRVqW5
-2j4ZDbvbTi4m8aHUc2mFt9jJfa2Dla50qjz1A4QR6EYGpXhmYU48K+1jX4HVOo6B
-M2sbA7o+suuvqRzn3nl9ikLhnX9G3c9rLdSA6ePg4cHsimsEw3FQgGIBx4mLCFb7
-Oyysb2TDyGnqc8v4amIOMMpgUlIdHEIyG9lnLetNrOhRS0+TVyD8fb93DOmLqhx5
-Lf1t5qXYfCUqjwcAPTnDR62nAA5hwLD7uS3M6P98SZdmXSuzSeHoxW90yyDt5v8M
-nQVYBGRwcNcBDACcY33SG13xJ5E+BJsDPnQq8aNP6kLAnSGInoOp990+VFp6FIbz
-XPKmXiUeECRQL3MpA0qtu8qg+Pfd8PIyahtdcTYnYSlAc4768F/xDZEdniCg72nF
-+EZ8T/RTSZXGf2FYuBgMcQpH5A1dsfkjot8E5bMgrYapSPMV8yYuFCVYaoo4/Rj7
-/3Wz9suV8S8bVaTRrqLxe8sLpdxNlpwTgqLR1aGI5HqXnYWGbvbZY0LjvLIjBj88
-Tf7HsHbx497M2/u+2eKNddfWCViAcuY0kHThpAFBLkQB3t0sw18BeerQMr9McabV
-8Cmw3TkBDL3A/TqAy/AjouiY9IrnRPmqCGEqdbrvFxMru7koa/llSb1BX/yUmXNB
-Lln4DDIHRlb23aZrc94lMlIZH+c4wp4jUM5fIp33JVkXuXftVjnWXTbeGA9FhNuF
-g4UWyrXpyPeTt3L7ywIS6xd82D8V0OawLD1LyMfnfbxETYItpWRa7YrRHKp23kKG
-T4xAhyD7FkkgPhUAEQEAAQAL/j+4H+dQJD4iR4Dz4m73buCidM6WXd1aCHRAVdgW
-eEwxlW3BWFznBaz4lfoCTLFpK+xNfYt9BOoClweUaTJWXlD71DtGUMcEboDbGNRA
-GVzudU/tTHUPnDSBZUTcKgznELRTyeSj2DMDfdirr52v+ltl9c6+NSxbX0QVvnwu
-1CqKukfPA/OFGiGZ0EiHLRDfm9idZaGrtUbJLRJl57DhXNLPTtJWeYa19VYZdzWK
-xpHA6/nuTSyWgNU/Fq+nDzv78xsbtQZSX63Oi7zOcd1AANmZY5aPiun98UiGwCvX
-ieGXoliuAsSzkJgjDaRmFth0YOPNnG2MaLa1Gx3V35cN7Xs40oXkWyvbpBV0+WGH
-J5/w/KuHbfnURUQKPyJVOB/AvT5dIrrWmJpNRRpZJzOYPUsYhHo7OVWQJITaTZhc
-vlsGQFM5qt38XGwtHPTCnBu9OLz6XnL9Ei39/Wtw6avsq1DWNy7hc21WXHUMi+Dr
-MPHKBBsl7L7mgg+T1msGyu/hXwYAwJOtq+YJcrLz4AQjuZ0vIsmdhup76SHUvgHH
-EDhWlYKAF9kFctquMh6L3TJ7Ygpi13whRVZWvL/qTqhIEO2t/fIbfnVfm6JJ28cR
-CAWvh/Z0phCX3D/+EFnAbfSgjV8dbA3Nwkw3NUda+GmJWAWO4VVysNBgnaBhoU3y
-MpL+B8p+6lNOPW+R1I4heAvtZX7qAkaz0ZhTiU2iEjHWWGwXuDOs9zNpq60e/qhb
-jhQ0viriWfemT3grpPm3mqUrOImvBgDP5MCTIC7yn9bs++n6MlI3pgIwUbxlLYj9
-y7JKrZDwiqMhBBGmcJc6i6L6aPiC5ezfAln+vRnQYHYY1cfsH69SvqJLfM4GrLP5
-y+oXCPnwuVotVr6+12z7RhkasGyRTSH85cmYZYmeDsTKTdvpT9ADlPa/09iMkVtQ
-kF/P6BauMbqo2971IMTir7DsjbbXWBE6y2KhEJpmcQHKL8Bkf4g34aEg63DXPfQk
-QW8yG4DGdDrUrQzYaRtSGgaisQ28GXsGAM3WGS+mqAZReOc00ecNKKjUX5saEuU6
-IzEIvA/92JPrwyFBq6TTY28Tv9nkblAlmoVaHRPGCJAFcjbH0jmONHOzJKaOJzx/
-uT9jBZPh2/6e6dq1hmTWrrgYW4ZWHYh3SCSEQS8oc7dhiPUGJy5idVosHy1TGRdI
-4Do9X84hE8VDxrY96gCSitIwVNqxqDYnKImNYF+aEnYOJiVuzukS15uTK61w555X
-D7vdBA4XSjFpIAEvqFE4jdBWAi09oqLzHNw6iQG8BBgBCgAmFiEEANPZ7fb3VHPW
-C0w3UsTUTh9UzVQFAmRwcNcCGwwFCQPCZwAACgkQUsTUTh9UzVTCDwv/fUJxiNGZ
-VBArNvxGoCVgewjisEAHsEg/X7dXYlQgHITbtV+lajCOXesuRy5hh3L/NPVDm9Yx
-WB0oZ/sV/qM7yisvGmf6OFxSvaGPr/aQhwIdkXw42veHe32pROujpmclI4QzIV9P
-4zOFUR0JHEaaJrS50S2VMmgX5fq2vBOQY8WIo8fUncPk1byeqwz9WfunPMZ+yc4C
-KIdQ1ysd+YFq9mTwYei/ZFQFyk+X3xxoIhlMd1LkynXV/Swrv11WBxqk0HPaWgc5
-WhUrK+gniZjPQVjOyHiKhu2rCBRXO1ipDdgdBX1aRe3XzsYJt0fI2qewm7ItxPk2
-wbbrfDD3kRu19PbxZYxesKLr5Pj0suIPNI0VWp2Te6HkcRgB8+fR8DAtbOCbo8Oy
-GgK0fz3gzhvhAUxoCRayo4iGTA6W4N+sryuOdDikRIirVxgksA2LLMwQzaSqllkh
-AoH/WKXfBxOQo9qDcxdBnCkM0bZF5tgrNqYf1IN3bZr2pV4CYo3Z2JaL
-=5CPG
+lQVYBGhek70BDACvHapdTLVc35G2r/JtpIbUqPRTvAcox7phoQr2DGqjedFht+vk
+GKS9MrlBT7reFXSZb81joZAVPgONdx5jbnZfxoiBLHBlwA8RYshhnShKzxvc3oHG
+4KqzmhVWTeKznKw1YUiHvJasU02NRTm+iHZSX4/7u4TXVcJ/lIUcc36v0XXh9LbC
+Yr4mwWgu2KzyTbDV8JJ9/hfsJMl5mpleCRpLh3oqpeAgWsOmstSHj9Smg6k+0W1e
+OzmGA2cb8t1OOAVr9RfxPeRgGMmt5ljudPXmYH5+qEk0ez9ZkZLWlUjaiv7NrXNm
+QRrJRUqw86pzzlIHBfp2aV8JTGJZf+r1i3XCq9JG03J16R6aRp6ZzLj3q/yod3NR
+P213zkP1GAwgqf8EbIHuRdwzcwQwe3D6Bh2b610G9Z1JwRKLQJxRPln6i/tSVp2y
+a0W00226frooNvQVf9Xu71AEoV5m/FxpWDJUvf3uoa0xFRyt7YrZNpLcWQfafQGC
+622JqfrDwDvJu2sAEQEAAQAL/jpZSyPtZFz+zaGuvLuV36tKZKbl9wi6jDrtmyZi
++sFf3MmPrBUDtRippxrBA0XupjxeCXTSJ508XZisgT6mVuEQ2PkZopX0ydCENrp3
+0C4lFmag6WMoBxjzFXr9VrV8VdEviihYSWhAFY4l69i1xZ8q4mIBmIDbvYQfK79Q
+KH1S8NGKZb8dgbiOJzW80tul0W9nypgaq0Pu+gb/4Wx44f8atDUzsht1ws1vtus4
+nKWjJyicRbHpUAB8b8XbRaxDc9WObeK+s9Dv6nAEn3se7TBEs8P1SD7OIR6iVuJD
+DstuFtqw8ptIogssEVHKLd89R8RhHNmqYAj6fJ2+pknJ9RDqQuIp5Ell3gkZm1+G
+JOexel1dL5eaWeN+tPULs+ARPKY16QrArimznq00jrw88A4/8WyIO2vYXHIpTmWC
+vzjmv7VgfgQYnE+6Bmza1bCxFoaagWVAi1UDAAGoOF8hhHLfoHR8MtZqW0hsnA1s
+FzpNVvSfxU03dnS7fdFZfwIW0QYAxP1XG0X1KMcVqD2ZMyRcFgDHdwQAZuTOB1dj
+YjWnlj9DhIRC9wJ12VYUdtWy3NAec7zWkqMMd4AAOumPT1vCLtpA9+53jJrdYTix
+nvrvXsnOXAzlwqiVzTxa78Hshy6TlV4XnQLCNf6f/IUe8tNUQIjpo8sZERxI/0IG
+snEQRRLb6H8/poI8WA/n7XfMOzFrqx7LrGEyipXdHHkZ86o0zntyiH9sDPO5UA5u
+RGjtDv/h7lRHX6hpBl9oEEKa4HSTBgDjkuGopr6apzU/ejaws1eHUOh7fXRmlUJu
+W44o0W01v6jBAnzDARryCxV5WKVVtF5Ye8Ik5QF20S7N4a3n52HzOuczAe5jNrKf
+Ofncr0rxAKMZS+iyH3uJCNlHipv2USYn8srcs405j+nBh3Fg34ZYRyazQF5+ukjF
+2fpfMKU2ds5bjF6LMZY5ghH0EvZ3RrMgebqsgqSakq9wDD7AQ5tlgR6GKmv4eIrI
+YNXRzCy1WBoMG6sV1GmxlkBw7y/tfMkGAMu+IiOdCeK+itN8Bx87I3qz5vopNJ8g
+EMQXnh4B/xlWeOzgpZ+IXlZGgZ9puIVyD34usisYuAVbLfSjrWybsfociqow8oL3
+0JqkU65tY/KeAdfsJI8R5RuJA0mAl5V43cDs5UczAKGrAVqRROZR1Fkm9tSnlta1
+rYRXvuM8803NiVKEjsftcuJCzx5ZUknaWexMWg0rcUUlNpskeY+lRx0LmAUWS8nD
+/Mu1KxTcaFw3d6En6mG1QXw/nJK4IkgWPNvPtCZUZXN0IFVzZXIgPHRlc3RwYXNz
+cGhyYXNlQGV4YW1wbGUuY29tPokB0QQTAQoAOxYhBLfkd2sJqokFdJd/WeJ42+Ct
+0N/BBQJoXpO9AhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEOJ42+Ct
+0N/B5RIMAKKQ3g01zKA1eFa4H0JYRHxfzcZYAvgyh/2HxAYdHRnJC/JX/IC0B5Oq
+AClj5uq+mDurSBeu9vp2E56hgZDyqrJFhBxNzcMNtrHYzT6YU3oYAMgzXywNHffw
+Jem1lZjqTuFfb+xsTfcRppWh/HNjt8L8uTg4s0xtmTKb3zEDi2RMNHYvrJau/c2T
+am46Go2NsrM9qMIwJ2xm6YGeTXi3pe7sfQ4m64ewe3wYETJmjZk6RUVlDLZonwVv
+ty20Butbh1292s7wvIHhp86D3r8i9Q/dvmI7nixXJo2E79fOkymK/kcDEwedgZCP
+/xb5tizS0+2vlk5BhWw/7thxuqfUbMJw3T6ttQe+yxE1/UcbfSC1i2pRHXHnw9sp
+uNE9bc/iMbZ9ITcMmH/KLAYr0YLvnrDLPCB3Aes7L/3UmJ4ezkyzr/vQEEdAxxhU
+oKB5UfRRcXClonQGTSkyygDlwt4YSVgnZMPQZZhyNV63Yo0NyfuF43h8al5sl2AZ
+fxUpsl04VZ0FWARoXpO9AQwA3vuZO8AOOWFkVcHtAd2RZuhskK5CIlqxNGpy/GSg
+90u6NcsEy16MXh01gFkVYtNPnXYcy1pcTzG+bW3p81u3Mrsri0xVIOTSWq8LPit5
+acLDPCZ6QhrokUcMyqBlO9vy2W6ip1jOEzgYYta+My/lDVdcWXz/J573MABMgK9B
+2G9UHbq5xbcfsdwUl7+HXkty5E8bJlDtMVNjUQGijai/OCiYZI98Le9tNup33/WR
+ugyXwdWeKjjLGxn662sYcyyM8LRket9s4Z9hNIMgUpd/Pfb36PZ/bhB3MbdFwMxz
+OjFN8XY2iN15X/G2Y30Fz9j0Xs14x3kzLwrDdR0iETw0ijW10G0HIxpIH2fcrgNY
+vnuLvvZxYRuSwCSPS3alj3NOKZpD/IYdQeq8ZVfCmjq2yVxRyGDBJurzNY/REbmX
+FFLEQLFaEPKy4eqyC6nMLIum1T8QIJAZiZM161Q8fJUQZ944O6TfHEFzTU+3TGDY
+t79OLv8H7XpVBjQ6OTC0Srr3ABEBAAEAC/wMlJJZIiVLTHjeM8I87DTDYxKY+RPn
+H0nHJMhXABBq011uooUjOjLeLnSxyJThzf08a4kFWhRCLZLKVryvy7lixdeXlNdq
+sy5BCoYuXEKN2nysXJliOGVtqN4KYpFDls21Qb4whdyejfgmP2pctfOM1KRzsg8t
+O5VDooiua/ThkqpiwQGxK3tAzCNnSlmHUudpBSOJfmBbe5JrZBW5O0+KihPK/KNr
+bgox4nmf65lsr0Ayoew6AplG7qjO9mxbNySjhPHaIhB/bVuWwbOkEB3Y/itjFjpN
+MzksN69qJte7ozza6jmV+rxSylj8BCPow9zNsgYGHy/LrP7FyLFwxRUIvg1FQYj/
+SS0iNNw86x67R6yGAgGWIcjB1L7ji1FhXlbRpMuxhms/0tRds/uoghe+zsOlGVqq
+YV8krd0q2rYVPLGg/VqBhPi7/FoGnmyao1DcepQ/FHCg1AqW3hh8YHE+Htb8dwb2
+1S25r+108Es1q/OaYF0+Dfc+Wve+WMgNGKkGAOQoRmGdeTJoxdhm0TNmyR4ZB5es
+M0fjT6u7jV1A/P6UjvtsYSpr2nVxGjKVCLazLlTLJ977ZlLFJkOYE2ootjAn2CUy
+EqsF4BjWFvex3h4QSLv5SJEEj325/OqnOw3u4yAWJqd3ukwE2H7ZRgToCPPn4jTV
+6mx6DBsQIKwwgRzrntM+23/EaNgawBd0xVCiHRKn+D+YoTJ/1dni39+oafzg8th7
+LF9KAKgu23rqK7nZx/3jNl/ePvN+ECIhB1SFyQYA+jGrcEImifCS1fr6oriGIumC
+bBx4kanbb+gm5pc0kFvxCvEvdyOJRymzL9MMyWdM+dq7hYEGgkeXQSKE10wkZEuN
+40FyE1RRFQFrTimfkim1exOetk72i/HX+ZCoqrtpwesLjQ9w01gDOjX4uVfI8lNY
+JkDgXtbZ4Dx4tz4J0a9MoxJcTdmzLRUB2HtJLssTCN5s47kkrzxnPYiIBp47aM19
+p7SgBP8p4yc36UxLBnh+PdmwoxfTKz24uqElwJq/Bf9qp/im5jZOg0ckmsLhrkdO
+8RK374y/EbVdERQPpeoCd8YYqTLHVmM0d2rWInOEJU6qRxkDniFUGqL+nknEz5vt
+gdp97dQzS1morXWHEWKRK0+zEwKF8jn5erG0JXuAf/nv8Mg9wXirp+32C44NRuou
+Lc6gHzuDU+JxCo/jp+zzoZRCAvQzST6eUXeOH4p7OrVqptmvEmh/8shaTVR5oplS
+vzEvE6YQoBnGubGz5Ws86EYl5k6WG9jbzYA9owK6H6XcMIkBtgQYAQoAIBYhBLfk
+d2sJqokFdJd/WeJ42+Ct0N/BBQJoXpO9AhsMAAoJEOJ42+Ct0N/BA2YMAIPW36GV
+JIabrkO279usvW4GNW12pjJmgXXf5NQO3uFPa0RtgvjWP5rBZFqXb8EHXgX3RGqm
+kqaTfS0L8C0EnueFH9NuFP48HZ4uXWp2cOS/YBdbB/nw/b3kavppIvSJf5vT1XwY
+eMUKSXGRU7pHJuRqu1b2IDP3Jf3bOjQS7je/eoYeUBcWxa6CZu7ehj6RfLHehgHI
+g/lm7K/bZLXT9uZifxYo7lQo48a9MdxzgL/6+vQQiU7UFCMJgognNbaR5qBP8ilY
+BL1JC9Yjcrx0ple8M5S50gDqiIs3ZVs23fzh8sGOrftabI1Av0S4pzifIiEiGzg4
+zIJDmms+QvWJ0XmkVeQrl9XPdww7RKiHSdksj/8XuEwhraI4pz41CQbYu+ceE0wz
+CvJeTuwm4ybp5SZ7l8y3wcRmHEVoBfYa4dhjezM2NT3J/4MYj4SrQK5wDfaV3hNW
+FelDv0SQJtioAMa/1isFK/eyqeEwnWafWzowtELLHrz5LMzgUTxclOqsWQ==
+=t+01
 -----END PGP PRIVATE KEY BLOCK-----
diff --git a/testdata/gpg-private.asc b/testdata/gpg-private.asc
index 9dd7c86..cc5818c 100644
--- a/testdata/gpg-private.asc
+++ b/testdata/gpg-private.asc
@@ -1,83 +1,17 @@
 -----BEGIN PGP PRIVATE KEY BLOCK-----
 
-lQWGBGRwcUEBDACzKYvl19Gqzdu2rwLx+Me+GvJkSemnvxdPvZhg+94uLmn+9oZp
-jmaLA8Kbjb73zfitKOdJojRKuBwyNtP7iPt85nWeWwq4LKHCQUo81Uh4lzv/0N58
-PNwFdRCHtD8MnhBRNv/kwccXyriikVbbi/dj+ISdKE7ueZ7SjgMFAa8JouiFldqZ
-uU7FgxaFxQ5o5NqTJF4XOdZQakW2A5PhLDmEMQ/fPJ5gFXPBzu+yCvAo0G6QkcJ5
-43mEOpJQwS79I1a8oS5txGiV0jP8PtyyAdIGuPW2B3oxmaNXllttYg2pnYR0Tr96
-5uMr8B2wcBdWAewH1wP0QKcKol5vxYuSwCOkwIjXtSLWMpYjtaS4FcWObUhvJiDI
-ypjLn1y2H6hW3oNT9W5nvaEgWqafdwBhF2BQJYcxAAmqIoIRY8k/JMLKuG6xdM4b
-opCCo37syvcHU4jNvXu7vr/8w7Y5Wc/yIVQARcm65DAZ3OPmIYKp8BDUnDgweUZj
-WaOWdYGB7+c8rDUAEQEAAf4HAwKdrS9IwGeeff9kQReq6FHd6Pp8KB807eqDBUAj
-BnUUtIE3iK2HJ++GohBXZemzTu4zl62krIGwWcwoqfckv9dIkWioem9JMbL7q4Jm
-6IChJ+EFvV6+I+C0lzM7L1lgKp6NZdcCnpfpSMrInVqzUqe4EbNaTDX5sN2IwdzR
-8rorZcQSL/ncDXg7vAhBtiKArtfyIPsWoxvEcPJ42ZMY3qM5p8zFmzoJsDwO2MWc
-K+UFrXJYZG43NoAOR5g7A+tHdcPLdQ/FT87tamyyULrVWnS6hDser4KlBN+Ez7bt
-GACWa2bYee+fn0VssWGhGxeV6coICmNENPRFtiQYMhvIbdS22Np+7ym6+7XJ6P0g
-f0iVi+3t3THXIJ84A/3uNnT2QG8BGmABsNzqK9TVMtHb4u8zLt6oG68WfnEumUo8
-ycm4PPstDuhd623b/aaqvD51tDsZR4GRYruM+LeHKGi6UYMCUutoUvna1aRgnz8D
-OCxz2emm+xsayz/+wo7UbD6CiTC9SPK0eAMYCghl0/wOcUFfp2hb8S7xzHg+HSEe
-vSUjM0V1Qf6l2AfsaWy1Yy/0ZtRtBNyxVkSwsmbvvUif9lXZNYsOnMSOTV4rmYwo
-QzKirhonkTkYv62GBRJZTYEVENrY9qUGrkYgCluGrVVNzFw2rTemvqX5IskMaaAZ
-EW4tSlP0fWs4DNiQQutCmKO/0FVgl1uWy2kSDEqSTE3/kT8Y+9hlj/itM9n7J4DT
-EqOhPZPit23OG5ahbGPUEODjXONmAlbwXmEUGf9KsnOaCRv2xYW9iT7fJrA7ivbV
-/DVwIprkbA6ACuSg4Fia+5DibxXh/JfSU3R9o1ugspZ9wbE8ay5GPbKrqSTT1Jlu
-JB0eY3HEDMEtVqbItedV2D7a/V5nfW3tZrIma0MyE7kAfJ3+ZqXWXww9ASLTUoZO
-wT9VFj8ktF+4fjKIHoycR8IInl56T4xhoz9CTzaHOvk8GHZF4+FX+G2/IkFdinkb
-Qbia26fGoS51o/rqzIHo4T15oBWXLSx7oHQhyyypzeRHmOKiStUI/rBnghl2Q8oJ
-xE/PUtXJDPkJHwc6cSCTV81G2kRQVh4iZg9ixJsXvNdAlB1GGOJH3VDuxPPCRq3s
-zJAPXOO28TwHyTipiw/wJ8Soyg4xpyoI2cp/CNpdo5f1mAruPr7XrdOHkl3obxRe
-OCVCmyevgg1PX9uV4JncRtsiFje+RJFuLTjkMVZLmccnUNqi/CpA5dPmHkg+0uK1
-1MVB+SJvjqr7ag+WbJuecuE84VD5Gr66CinOywfluRA+pLGdCIuxRZdTmgiVeh5S
-bH3jhXBljzhFK2I9GJ0RVKDRsdu6iOrEW7QmVGVzdCBVc2VyIDx0ZXN0cGFzc3Bo
-cmFzZUBleGFtcGxlLmNvbT6JAdQEEwEKAD4WIQTG5NstFF+myfSEwuHX3t0O/q5z
-ogUCZHBxQQIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDX3t0O
-/q5zolo2C/429RV2EhFG5EYKfLCd72ANLzUX9Kezk8tq3JDOYkRuqGF2y6HzuAcx
-DYytRoyxTkCpxiuwPnxnU76cSSxn5+UZD+0sa5OGZYMtrCVSd56dXQkK0drf+RUo
-apFLC6ufWmHox74ZIuTyPLj4YlsbSU3mE8CqVWY4Svk5W920wZDS7lrHSkXtKqh2
-QtE/7/mTXCxu1HNqfck5ROIbA0MTKX2FG+3gujjJcZBEI8nkIdvI0XouOHXLZLKq
-kh8//w1XsQeielOXO/+pQyT3lSwcZry4F112S4bMO+R12uWO6Hxwe9LoQb3gDmO5
-H9LsssdpHC+bhJnTURGixiMuyzjFSmfVzzgU2YeP69R+GHxLMwMAo/a89eWFxiZI
-6jMOx7TgYC9fg+Z8weTBq8fy8E5tT/LJm2VrBm3vuTgC4MePdBDy+AuEPyt3J2fX
-1KS2vNlASeh6ONhMk+BMVWG0KWs3GVyF2DcXUCTX1xVI9uT+eJSR7UPJ+kRnIfO0
-RzxL30Qxvw6dBYYEZHBxQQEMAMDLFiDTpnqsjH9li97yBOdG3SOu9EttdQXXopdh
-EPJDxDCBHqfZvfjHuA5gfIP8bghQsXYCnn5k6dHZHdkJ9LfJTj8Wyh2cumhxPO2e
-wbOmhQgLC54hmi0s64tj9GxM95aZk8umkTdXt+F9a4WihHGlgeCdpq+B6EQodDCU
-ysJgnlCUGgjK/ptl4PhQtsgXk/mw0oOQukoulFFkfdlLEhWYNMz0/5oAMdGLa//W
-8cjK2E5UN3/1PFF1nvzsHca/fGb1JvUwgrTjeJC4H10Vo4KvmYkpb943auoGJEJU
-QbM/A7cDQvzB1OD/UpG6vYmarXCjGe2ZrJs+RI+bXMXLfsdCveLo1DPhpF7hLD+t
-F2NI9oM/cEXuQBwl3mLOjFOn0Q1jXDD0uyzEJN7DKlnITyBV87hv2+hMGftnQwmX
-iXw8rkBeaDLl4ShG3MLCr8KpcvtgtVf9ceZxO6K0CGTj+VSfKQ34HrWEoNzNoRoM
-5dSPK6YXNRL2JizVRrAkVoRCzwARAQAB/gcDAqMHMJr6Gorz/9bZTyXQGO/oXkN8
-D+G3Gn0n0iAmsH1nBo1qo61JosRAhhO+Z286F33tS/TqcblQVCsgPYFN93qX1yoB
-RON619o3s+mF9PtSLvbUDdUa04eLarhH3RoCkkpoh+3df0xw+Jtpx2+eZibo32vb
-U0e9lIO9Kv1I11Y2xSymFTzO+hK7IKYAvP9uzYty/r0rcgotJHr4B+k5jCQHXZhW
-u0/68b7Y/JOUxKSag5r3PyyDWyJibRGi2ILwKogL5D4YdAtZYUNemmK9Is31NIs/
-6jWHedOuRsBlM46NwwJs8ybtqy0TLDQhfrn2jUY/U+BMWSV4u8Ra33PaOyqv/EeN
-hbySg2DTVnAlxzdw/z7oDPROtW1FzdFPVvOAUYOGuzlEhVAVzdhX9EfBahMIy7/B
-sSlKoFOCMOngsnFrmxAMbUW49ZoTRzAunTVFNgqQJZLHmzPiyyierNP5FzjG+wO+
-lprurp8RXFQ2KQ5hoF8Mw+F4V+mP+RAtO5P05rcp/PJafwdvxS03LZZchB3hRWQi
-pGBum37nxN4ztbduUwWk+DKgB1pkPthF+i2cKlBgNzL/bfbmJoiIZghUKIgCZoXp
-3PRwa2DM4CoFoC5FuhFV50CpqbrVeZAAK2Q3InphbdWZb5os9YqFfteLzk316zCj
-vqftiZ4C5WPqMtesLGSeXNOna8vm5AOzt8qohmrLhdoONxBqf3sbykyzU567AWtm
-P02u1JWQgGJnsRO+3j441VSK5SSmolCdDP+LspfZPCRZel+pBwlTJ6IpuFxB7zj1
-UpkfT6r//bVfriwe6rFZ0VI3BfefJLrCIrgI0V/IFu1rjcciNV1PXwAdJNNhN3X4
-4zPktSVR8u/Nz8jNgdSgXBYMkuv+QTjvzBvCMu5tP7ufXVXG6jAEJHeUh+633HGJ
-o6NTsOZFhYwLmwTh4CBplt7bclsysOQGgo3SWHO3axCWrRX9uNVq0uIKjl3CHkqW
-3dbQzFlY3raWT9q19g3cuiA8BZqh/NswIQDrOFS4pGrbTQFWY0zQZqFlHEyVCgwb
-TtbcpjOBy3O2fsbFvepYDbcTYbmcacZSZFtTMiQGt3Ga+TeGsO+VIUzNgmpLkyWS
-1QQjvqNKZnKWT6f4A7Lbj1OZqG/v4540jmOxShcHrz2Klwdrra6Ie7yERYmyPMZJ
-98r2BFk04QaYK7r9xy7hJGBDmwT0VOcJXDAVA3HJJHGltnNKke2vP95JLmyahORP
-efEsi0UPsQqkCS7iWV9ucUtKEnYzoHFSeSXU64+Cme6T+7FxJ9E2f5Ep88nz7ucg
-EwgSiWsdqzEjntq5MAr6rSSk8ZKPzRbR61exuf7tWRa1iQG8BBgBCgAmFiEExuTb
-LRRfpsn0hMLh197dDv6uc6IFAmRwcUECGwwFCQPCZwAACgkQ197dDv6uc6K7qQv/
-brSaC5ICGKIpzsIf6lIp6Wrn7smsGh9BI+dH19prXQ5lT6Iv+IFZmNiDGXtVzOOK
-Y8VgqwJmf/XwjgH2dod3X61ts3krtnZ2znCgrz08NRxG4G9ok8Fa5fLCrZBWi7UU
-4ZH63rS9optmqEMzwCwQ94U0glU8C9Hc44MVCSrrrD2+/H/PTFVr37iwBugZsDq4
-4gUTyGBYumnzTVyi2ZbJn89Amd8fl280QWSkdebmljnk4OjlTZbXkRGiIu65ggr9
-ikg11TRlPD0L9NTo8w2OtjoYXr50xL1odyNlz6RKcQlX80EjKMXvVxNE32J4JCBj
-tHrqiTDCs1bdXTh2xCvF0DatJMeUn3/WDn6UYjZzlZvZCOcjQLrPgJplJowLwd96
-YaUfZ11WNAgNy8vZjUroMNyD2J+GsLr+QZOqFRP362+Juj5MqANXAuKEQ4qzs2Fv
-/Z6cUYKuENmsNDY8ORG7ON95AFl5i0daP7+EoHDMb7+tyG54JxE4Szxhe4skRXXr
-=Ze5I
+lIYEaF6UehYJKwYBBAHaRw8BAQdAPKJ2JvwUyE7dy8bjVgBCjdRXSTw2BPl6wayP
+o0WwhvT+BwMC8CxbenuzELD/Z524BTjgiXXgPS8rnRkSqww5Swa0d4mhtTn2w0pq
+jRnHmVyLhh9n7e8GZaS9+8CFu3UWtkHgbRrzdyRg9KuFaW0ogcWA5bQmVGVzdCBV
+c2VyIDx0ZXN0cGFzc3BocmFzZUBleGFtcGxlLmNvbT6IkwQTFgoAOxYhBF3PQjaj
+rT/hLkdhdu9/tDIYmfSXBQJoXpR6AhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4H
+AheAAAoJEO9/tDIYmfSX0zsBAJ4Tay/2jNMqye9RfiEn6B5e5IO+QymL52q6bF1z
+ZNLDAP94yfwvG+7fL6W3XOTUr9unsCU9W0T0lAfFLmZY2WoeApyLBGhelHoSCisG
+AQQBl1UBBQEBB0BMy3qqyiYPkalTZNUw/VSgHEOJF0Yi6fFi+DnEWtapKAMBCAf+
+BwMCla2r1+brAiD/zuhRDXfJC1oRoEnDq/JgmsU14t6PNCPK6MPA+dmV3kCIVbjy
+A97PMx6HBSTJZYdzGY8e2XdwzrVG4vbzH2yJ55LbawgFYIh4BBgWCgAgFiEEXc9C
+NqOtP+EuR2F273+0MhiZ9JcFAmhelHoCGwwACgkQ73+0MhiZ9JeinQEAip+eryNU
+T9X80S4YilMZg7djkmGfMJnEZiKYU8TEsFQBAN2D3PDAVNKs2ZOVp1GQMDse7sQ6
+5C3faX2ZMchuKLwF
+=RH4D
 -----END PGP PRIVATE KEY BLOCK-----
diff --git a/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml b/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml
index db74ade..a4e20b1 100644
--- a/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml
+++ b/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml
@@ -4,91 +4,93 @@ name: Upload/download a signed release (no GPG passphrase)
 on: [push]
 env:
   gpg_private_key: |
-    -----BEGIN PGP PRIVATE KEY BLOCK-----
-    
-    lQVYBGRwcNcBDADUZUxCbjw0hOtMaLIYhEbgYFR2Oyxz8IDJTVALuLGQbHnLM6La
-    IVxGwk9CgxX8vP9pN3Fy+uX+KInV41bLGd30qPDvqCuAbAo4bAT0Sg/fN3A7fuSX
-    KfUStJbY3OyQZQbHWxOpsyIziIqBMXipgFQD/IncRMhWjcQh4znnkUb+e3oj1/f1
-    9eErwfgsiDsj7M/FSWolrwttd2VQah+WumhVFjvb+M4j5zI9UBNGNsVCTxQXTN5L
-    MtPJuypuMzawmTvUNm7470VDgO/dCWGlZ7gshoNd2fNnFCMgTSWYu9C8zFCkFOi2
-    ZiwmIQTu3QBDNXaqR7r9j1s9q4hrloEZwmTFXV+PvEczUXx+8Scq8ONZGJdjo6NL
-    mp1fM5//o3Vfl0oJsQf2WS/bpyJQDZEQaKGekHJ5W4OuH9+mzDfqkkpTl/aduVN7
-    uXF4AYfdZMOqNjkNpi3RAh54LKVtqaeVRzypAnjn8Vb2WHw7tQX9S4DDUtul9Pyx
-    a6xqLdtJYw/PwaUAEQEAAQAL/2HSZdUSwFfQAC8o6R2xjpM4yq3JgyfC1Q3htcQw
-    RFeoHlAgcBjW1JEiXS7dAPtucJQdHPs/4z2znggMtKTGPRu5034NjjuPhwWFeqKo
-    mbbM6bv9LXsRr/X1hqRK3AmE/iJDKEM4ZcAmWuQ1zMUEfa14WmZAp6R1lqek575n
-    grMiW5a2mVWG8TYeGBcqh1J8dxT+Qw0oGbNJEjh/KB1brUHDA77EUOzoRpNGlhn4
-    j9GCalZw6NDpj/GRanFm1QFxEO5NPi5wnwzlM1+PU7jva3aHQFr8pQbgVv0bBEcR
-    5Dsj1vB/+Dwv1sgSUs3qfjnWnbcpY3+j4TTRWwJTtEufqSPtZSu3/o2K3NenaQGu
-    pbeDRHWMxrfIfUe65uOFgsgO5gBL0NjIh6D0pDYJUSzcxP7oPTMjBHcfjyxAjJrj
-    YNlVyrHlKGMUNbjhodBS+5y5A5ugIi9N0W2DjFMFug296foGIBoVuVpqiiEJls4d
-    FedKD9fhFvYh2BwqvYdQpexk4QYA5Firzcgr0By2OffnfbcxjzJR4wlHafKdTIag
-    bcPYpaOJKKfchHPAIzQ++HZ147qAabpcwENL1uEz4gRpVlr4JPkcOABsSl6xezm2
-    QxWTEmnrzUvmyspD858rBCGAv7/sUhP5Bj6fL4wr+N1qLu5F7Wy96yJSVn9EA5om
-    q2MhfMcvgV/mjtiLjCWdyuJjFJ1vqXVg2I/yXoNmPNO6f1JpjwcZjd/140WcCIvm
-    VjWHlHEgfnAZkxoBfNhvofeDqQn7BgDuHh1Ph+AjXBSvmQPA7+3DxvAe5zK1xkgs
-    PEwFH6I3hfz6uQizENyTgUYP721/8Iz3jXsz8GMOJ+XGLA6tUav37mW7xP7kQTU/
-    QNUt8v+eEL+Yo5/3oHjD63P6YnzAzWiUhPYziRcSUeCbD0BFtepIVXkFo3M0/U5k
-    KjB/KtpuinNRaOBE6NRwyJ83cneFNKLy2Tlmf98yhSKAiuiCpzS9KVtqKrnjv7ho
-    uyOoi6jyXAFLm48gR6QF8HHPmmNDMN8F+wTJgOOir8Q6FOSSLlLXbgakZnUf33j9
-    7Vqn/PnFTLUmV7rmJUgfB/nHogN19ibYs2Dnfi/EC5suqqf6qr77JZD1UVZE2Zrm
-    5F4AXy8ZIm0yVO/bODZ+h6PnFI/9v/8FsxAMD8Ksrte6KtLLfhbZ7xQkroSazc0q
-    rAgpq6NmLtreurjSA7/yZwZ5dZq/FdEi33GQ6RtGXUTW5sblk4D/r03BkwPFr9WW
-    30YpLhPFoWvJyXlEGJaUMmpJxdHcRNCPE+bDtBxUZXN0IFVzZXIgPHRlc3RAZXhh
-    bXBsZS5jb20+iQHUBBMBCgA+FiEEANPZ7fb3VHPWC0w3UsTUTh9UzVQFAmRwcNcC
-    GwMFCQPCZwAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQUsTUTh9UzVTbWgwA
-    t0Wlo052dkF44Tq+AWn7C1duxNd8Tf8jNDkat5O1OgNL0JfXaklwAFUhf3QaWvxn
-    SbtEMTryhVyW/YA2mICuilBeATLycA1ch91pKr0W3P+8pWLnAKyjCnxY1JkgypDs
-    TgnBwlW1bt27qpKxlEv/UN786DGsYsWCy1j+X8k7ayO5WWjVkwfmQc/C57dv0Mxy
-    ONBwLyIuYBoQ6pfzCXu3aBBaXy1dYZ4FYF4BBnyfftt3obIJo/rrXPD7aBvRVqW5
-    2j4ZDbvbTi4m8aHUc2mFt9jJfa2Dla50qjz1A4QR6EYGpXhmYU48K+1jX4HVOo6B
-    M2sbA7o+suuvqRzn3nl9ikLhnX9G3c9rLdSA6ePg4cHsimsEw3FQgGIBx4mLCFb7
-    Oyysb2TDyGnqc8v4amIOMMpgUlIdHEIyG9lnLetNrOhRS0+TVyD8fb93DOmLqhx5
-    Lf1t5qXYfCUqjwcAPTnDR62nAA5hwLD7uS3M6P98SZdmXSuzSeHoxW90yyDt5v8M
-    nQVYBGRwcNcBDACcY33SG13xJ5E+BJsDPnQq8aNP6kLAnSGInoOp990+VFp6FIbz
-    XPKmXiUeECRQL3MpA0qtu8qg+Pfd8PIyahtdcTYnYSlAc4768F/xDZEdniCg72nF
-    +EZ8T/RTSZXGf2FYuBgMcQpH5A1dsfkjot8E5bMgrYapSPMV8yYuFCVYaoo4/Rj7
-    /3Wz9suV8S8bVaTRrqLxe8sLpdxNlpwTgqLR1aGI5HqXnYWGbvbZY0LjvLIjBj88
-    Tf7HsHbx497M2/u+2eKNddfWCViAcuY0kHThpAFBLkQB3t0sw18BeerQMr9McabV
-    8Cmw3TkBDL3A/TqAy/AjouiY9IrnRPmqCGEqdbrvFxMru7koa/llSb1BX/yUmXNB
-    Lln4DDIHRlb23aZrc94lMlIZH+c4wp4jUM5fIp33JVkXuXftVjnWXTbeGA9FhNuF
-    g4UWyrXpyPeTt3L7ywIS6xd82D8V0OawLD1LyMfnfbxETYItpWRa7YrRHKp23kKG
-    T4xAhyD7FkkgPhUAEQEAAQAL/j+4H+dQJD4iR4Dz4m73buCidM6WXd1aCHRAVdgW
-    eEwxlW3BWFznBaz4lfoCTLFpK+xNfYt9BOoClweUaTJWXlD71DtGUMcEboDbGNRA
-    GVzudU/tTHUPnDSBZUTcKgznELRTyeSj2DMDfdirr52v+ltl9c6+NSxbX0QVvnwu
-    1CqKukfPA/OFGiGZ0EiHLRDfm9idZaGrtUbJLRJl57DhXNLPTtJWeYa19VYZdzWK
-    xpHA6/nuTSyWgNU/Fq+nDzv78xsbtQZSX63Oi7zOcd1AANmZY5aPiun98UiGwCvX
-    ieGXoliuAsSzkJgjDaRmFth0YOPNnG2MaLa1Gx3V35cN7Xs40oXkWyvbpBV0+WGH
-    J5/w/KuHbfnURUQKPyJVOB/AvT5dIrrWmJpNRRpZJzOYPUsYhHo7OVWQJITaTZhc
-    vlsGQFM5qt38XGwtHPTCnBu9OLz6XnL9Ei39/Wtw6avsq1DWNy7hc21WXHUMi+Dr
-    MPHKBBsl7L7mgg+T1msGyu/hXwYAwJOtq+YJcrLz4AQjuZ0vIsmdhup76SHUvgHH
-    EDhWlYKAF9kFctquMh6L3TJ7Ygpi13whRVZWvL/qTqhIEO2t/fIbfnVfm6JJ28cR
-    CAWvh/Z0phCX3D/+EFnAbfSgjV8dbA3Nwkw3NUda+GmJWAWO4VVysNBgnaBhoU3y
-    MpL+B8p+6lNOPW+R1I4heAvtZX7qAkaz0ZhTiU2iEjHWWGwXuDOs9zNpq60e/qhb
-    jhQ0viriWfemT3grpPm3mqUrOImvBgDP5MCTIC7yn9bs++n6MlI3pgIwUbxlLYj9
-    y7JKrZDwiqMhBBGmcJc6i6L6aPiC5ezfAln+vRnQYHYY1cfsH69SvqJLfM4GrLP5
-    y+oXCPnwuVotVr6+12z7RhkasGyRTSH85cmYZYmeDsTKTdvpT9ADlPa/09iMkVtQ
-    kF/P6BauMbqo2971IMTir7DsjbbXWBE6y2KhEJpmcQHKL8Bkf4g34aEg63DXPfQk
-    QW8yG4DGdDrUrQzYaRtSGgaisQ28GXsGAM3WGS+mqAZReOc00ecNKKjUX5saEuU6
-    IzEIvA/92JPrwyFBq6TTY28Tv9nkblAlmoVaHRPGCJAFcjbH0jmONHOzJKaOJzx/
-    uT9jBZPh2/6e6dq1hmTWrrgYW4ZWHYh3SCSEQS8oc7dhiPUGJy5idVosHy1TGRdI
-    4Do9X84hE8VDxrY96gCSitIwVNqxqDYnKImNYF+aEnYOJiVuzukS15uTK61w555X
-    D7vdBA4XSjFpIAEvqFE4jdBWAi09oqLzHNw6iQG8BBgBCgAmFiEEANPZ7fb3VHPW
-    C0w3UsTUTh9UzVQFAmRwcNcCGwwFCQPCZwAACgkQUsTUTh9UzVTCDwv/fUJxiNGZ
-    VBArNvxGoCVgewjisEAHsEg/X7dXYlQgHITbtV+lajCOXesuRy5hh3L/NPVDm9Yx
-    WB0oZ/sV/qM7yisvGmf6OFxSvaGPr/aQhwIdkXw42veHe32pROujpmclI4QzIV9P
-    4zOFUR0JHEaaJrS50S2VMmgX5fq2vBOQY8WIo8fUncPk1byeqwz9WfunPMZ+yc4C
-    KIdQ1ysd+YFq9mTwYei/ZFQFyk+X3xxoIhlMd1LkynXV/Swrv11WBxqk0HPaWgc5
-    WhUrK+gniZjPQVjOyHiKhu2rCBRXO1ipDdgdBX1aRe3XzsYJt0fI2qewm7ItxPk2
-    wbbrfDD3kRu19PbxZYxesKLr5Pj0suIPNI0VWp2Te6HkcRgB8+fR8DAtbOCbo8Oy
-    GgK0fz3gzhvhAUxoCRayo4iGTA6W4N+sryuOdDikRIirVxgksA2LLMwQzaSqllkh
-    AoH/WKXfBxOQo9qDcxdBnCkM0bZF5tgrNqYf1IN3bZr2pV4CYo3Z2JaL
-    =5CPG
-    -----END PGP PRIVATE KEY BLOCK-----
+     -----BEGIN PGP PRIVATE KEY BLOCK-----
+
+     lQVYBGhek70BDACvHapdTLVc35G2r/JtpIbUqPRTvAcox7phoQr2DGqjedFht+vk
+     GKS9MrlBT7reFXSZb81joZAVPgONdx5jbnZfxoiBLHBlwA8RYshhnShKzxvc3oHG
+     4KqzmhVWTeKznKw1YUiHvJasU02NRTm+iHZSX4/7u4TXVcJ/lIUcc36v0XXh9LbC
+     Yr4mwWgu2KzyTbDV8JJ9/hfsJMl5mpleCRpLh3oqpeAgWsOmstSHj9Smg6k+0W1e
+     OzmGA2cb8t1OOAVr9RfxPeRgGMmt5ljudPXmYH5+qEk0ez9ZkZLWlUjaiv7NrXNm
+     QRrJRUqw86pzzlIHBfp2aV8JTGJZf+r1i3XCq9JG03J16R6aRp6ZzLj3q/yod3NR
+     P213zkP1GAwgqf8EbIHuRdwzcwQwe3D6Bh2b610G9Z1JwRKLQJxRPln6i/tSVp2y
+     a0W00226frooNvQVf9Xu71AEoV5m/FxpWDJUvf3uoa0xFRyt7YrZNpLcWQfafQGC
+     622JqfrDwDvJu2sAEQEAAQAL/jpZSyPtZFz+zaGuvLuV36tKZKbl9wi6jDrtmyZi
+     +sFf3MmPrBUDtRippxrBA0XupjxeCXTSJ508XZisgT6mVuEQ2PkZopX0ydCENrp3
+     0C4lFmag6WMoBxjzFXr9VrV8VdEviihYSWhAFY4l69i1xZ8q4mIBmIDbvYQfK79Q
+     KH1S8NGKZb8dgbiOJzW80tul0W9nypgaq0Pu+gb/4Wx44f8atDUzsht1ws1vtus4
+     nKWjJyicRbHpUAB8b8XbRaxDc9WObeK+s9Dv6nAEn3se7TBEs8P1SD7OIR6iVuJD
+     DstuFtqw8ptIogssEVHKLd89R8RhHNmqYAj6fJ2+pknJ9RDqQuIp5Ell3gkZm1+G
+     JOexel1dL5eaWeN+tPULs+ARPKY16QrArimznq00jrw88A4/8WyIO2vYXHIpTmWC
+     vzjmv7VgfgQYnE+6Bmza1bCxFoaagWVAi1UDAAGoOF8hhHLfoHR8MtZqW0hsnA1s
+     FzpNVvSfxU03dnS7fdFZfwIW0QYAxP1XG0X1KMcVqD2ZMyRcFgDHdwQAZuTOB1dj
+     YjWnlj9DhIRC9wJ12VYUdtWy3NAec7zWkqMMd4AAOumPT1vCLtpA9+53jJrdYTix
+     nvrvXsnOXAzlwqiVzTxa78Hshy6TlV4XnQLCNf6f/IUe8tNUQIjpo8sZERxI/0IG
+     snEQRRLb6H8/poI8WA/n7XfMOzFrqx7LrGEyipXdHHkZ86o0zntyiH9sDPO5UA5u
+     RGjtDv/h7lRHX6hpBl9oEEKa4HSTBgDjkuGopr6apzU/ejaws1eHUOh7fXRmlUJu
+     W44o0W01v6jBAnzDARryCxV5WKVVtF5Ye8Ik5QF20S7N4a3n52HzOuczAe5jNrKf
+     Ofncr0rxAKMZS+iyH3uJCNlHipv2USYn8srcs405j+nBh3Fg34ZYRyazQF5+ukjF
+     2fpfMKU2ds5bjF6LMZY5ghH0EvZ3RrMgebqsgqSakq9wDD7AQ5tlgR6GKmv4eIrI
+     YNXRzCy1WBoMG6sV1GmxlkBw7y/tfMkGAMu+IiOdCeK+itN8Bx87I3qz5vopNJ8g
+     EMQXnh4B/xlWeOzgpZ+IXlZGgZ9puIVyD34usisYuAVbLfSjrWybsfociqow8oL3
+     0JqkU65tY/KeAdfsJI8R5RuJA0mAl5V43cDs5UczAKGrAVqRROZR1Fkm9tSnlta1
+     rYRXvuM8803NiVKEjsftcuJCzx5ZUknaWexMWg0rcUUlNpskeY+lRx0LmAUWS8nD
+     /Mu1KxTcaFw3d6En6mG1QXw/nJK4IkgWPNvPtCZUZXN0IFVzZXIgPHRlc3RwYXNz
+     cGhyYXNlQGV4YW1wbGUuY29tPokB0QQTAQoAOxYhBLfkd2sJqokFdJd/WeJ42+Ct
+     0N/BBQJoXpO9AhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEOJ42+Ct
+     0N/B5RIMAKKQ3g01zKA1eFa4H0JYRHxfzcZYAvgyh/2HxAYdHRnJC/JX/IC0B5Oq
+     AClj5uq+mDurSBeu9vp2E56hgZDyqrJFhBxNzcMNtrHYzT6YU3oYAMgzXywNHffw
+     Jem1lZjqTuFfb+xsTfcRppWh/HNjt8L8uTg4s0xtmTKb3zEDi2RMNHYvrJau/c2T
+     am46Go2NsrM9qMIwJ2xm6YGeTXi3pe7sfQ4m64ewe3wYETJmjZk6RUVlDLZonwVv
+     ty20Butbh1292s7wvIHhp86D3r8i9Q/dvmI7nixXJo2E79fOkymK/kcDEwedgZCP
+     /xb5tizS0+2vlk5BhWw/7thxuqfUbMJw3T6ttQe+yxE1/UcbfSC1i2pRHXHnw9sp
+     uNE9bc/iMbZ9ITcMmH/KLAYr0YLvnrDLPCB3Aes7L/3UmJ4ezkyzr/vQEEdAxxhU
+     oKB5UfRRcXClonQGTSkyygDlwt4YSVgnZMPQZZhyNV63Yo0NyfuF43h8al5sl2AZ
+     fxUpsl04VZ0FWARoXpO9AQwA3vuZO8AOOWFkVcHtAd2RZuhskK5CIlqxNGpy/GSg
+     90u6NcsEy16MXh01gFkVYtNPnXYcy1pcTzG+bW3p81u3Mrsri0xVIOTSWq8LPit5
+     acLDPCZ6QhrokUcMyqBlO9vy2W6ip1jOEzgYYta+My/lDVdcWXz/J573MABMgK9B
+     2G9UHbq5xbcfsdwUl7+HXkty5E8bJlDtMVNjUQGijai/OCiYZI98Le9tNup33/WR
+     ugyXwdWeKjjLGxn662sYcyyM8LRket9s4Z9hNIMgUpd/Pfb36PZ/bhB3MbdFwMxz
+     OjFN8XY2iN15X/G2Y30Fz9j0Xs14x3kzLwrDdR0iETw0ijW10G0HIxpIH2fcrgNY
+     vnuLvvZxYRuSwCSPS3alj3NOKZpD/IYdQeq8ZVfCmjq2yVxRyGDBJurzNY/REbmX
+     FFLEQLFaEPKy4eqyC6nMLIum1T8QIJAZiZM161Q8fJUQZ944O6TfHEFzTU+3TGDY
+     t79OLv8H7XpVBjQ6OTC0Srr3ABEBAAEAC/wMlJJZIiVLTHjeM8I87DTDYxKY+RPn
+     H0nHJMhXABBq011uooUjOjLeLnSxyJThzf08a4kFWhRCLZLKVryvy7lixdeXlNdq
+     sy5BCoYuXEKN2nysXJliOGVtqN4KYpFDls21Qb4whdyejfgmP2pctfOM1KRzsg8t
+     O5VDooiua/ThkqpiwQGxK3tAzCNnSlmHUudpBSOJfmBbe5JrZBW5O0+KihPK/KNr
+     bgox4nmf65lsr0Ayoew6AplG7qjO9mxbNySjhPHaIhB/bVuWwbOkEB3Y/itjFjpN
+     MzksN69qJte7ozza6jmV+rxSylj8BCPow9zNsgYGHy/LrP7FyLFwxRUIvg1FQYj/
+     SS0iNNw86x67R6yGAgGWIcjB1L7ji1FhXlbRpMuxhms/0tRds/uoghe+zsOlGVqq
+     YV8krd0q2rYVPLGg/VqBhPi7/FoGnmyao1DcepQ/FHCg1AqW3hh8YHE+Htb8dwb2
+     1S25r+108Es1q/OaYF0+Dfc+Wve+WMgNGKkGAOQoRmGdeTJoxdhm0TNmyR4ZB5es
+     M0fjT6u7jV1A/P6UjvtsYSpr2nVxGjKVCLazLlTLJ977ZlLFJkOYE2ootjAn2CUy
+     EqsF4BjWFvex3h4QSLv5SJEEj325/OqnOw3u4yAWJqd3ukwE2H7ZRgToCPPn4jTV
+     6mx6DBsQIKwwgRzrntM+23/EaNgawBd0xVCiHRKn+D+YoTJ/1dni39+oafzg8th7
+     LF9KAKgu23rqK7nZx/3jNl/ePvN+ECIhB1SFyQYA+jGrcEImifCS1fr6oriGIumC
+     bBx4kanbb+gm5pc0kFvxCvEvdyOJRymzL9MMyWdM+dq7hYEGgkeXQSKE10wkZEuN
+     40FyE1RRFQFrTimfkim1exOetk72i/HX+ZCoqrtpwesLjQ9w01gDOjX4uVfI8lNY
+     JkDgXtbZ4Dx4tz4J0a9MoxJcTdmzLRUB2HtJLssTCN5s47kkrzxnPYiIBp47aM19
+     p7SgBP8p4yc36UxLBnh+PdmwoxfTKz24uqElwJq/Bf9qp/im5jZOg0ckmsLhrkdO
+     8RK374y/EbVdERQPpeoCd8YYqTLHVmM0d2rWInOEJU6qRxkDniFUGqL+nknEz5vt
+     gdp97dQzS1morXWHEWKRK0+zEwKF8jn5erG0JXuAf/nv8Mg9wXirp+32C44NRuou
+     Lc6gHzuDU+JxCo/jp+zzoZRCAvQzST6eUXeOH4p7OrVqptmvEmh/8shaTVR5oplS
+     vzEvE6YQoBnGubGz5Ws86EYl5k6WG9jbzYA9owK6H6XcMIkBtgQYAQoAIBYhBLfk
+     d2sJqokFdJd/WeJ42+Ct0N/BBQJoXpO9AhsMAAoJEOJ42+Ct0N/BA2YMAIPW36GV
+     JIabrkO279usvW4GNW12pjJmgXXf5NQO3uFPa0RtgvjWP5rBZFqXb8EHXgX3RGqm
+     kqaTfS0L8C0EnueFH9NuFP48HZ4uXWp2cOS/YBdbB/nw/b3kavppIvSJf5vT1XwY
+     eMUKSXGRU7pHJuRqu1b2IDP3Jf3bOjQS7je/eoYeUBcWxa6CZu7ehj6RfLHehgHI
+     g/lm7K/bZLXT9uZifxYo7lQo48a9MdxzgL/6+vQQiU7UFCMJgognNbaR5qBP8ilY
+     BL1JC9Yjcrx0ple8M5S50gDqiIs3ZVs23fzh8sGOrftabI1Av0S4pzifIiEiGzg4
+     zIJDmms+QvWJ0XmkVeQrl9XPdww7RKiHSdksj/8XuEwhraI4pz41CQbYu+ceE0wz
+     CvJeTuwm4ybp5SZ7l8y3wcRmHEVoBfYa4dhjezM2NT3J/4MYj4SrQK5wDfaV3hNW
+     FelDv0SQJtioAMa/1isFK/eyqeEwnWafWzowtELLHrz5LMzgUTxclOqsWQ==
+     =t+01
+     -----END PGP PRIVATE KEY BLOCK-----
 
 jobs:
   upload-gpg-no-passphrase:
-    runs-on: ubuntu-latest
+    runs-on: docker
+    container:
+      image: 'data.forgejo.org/oci/node:22-bookworm'
     steps:
       - uses: actions/checkout@v4
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
diff --git a/testdata/upload-download/.forgejo/workflows/gpg.yml b/testdata/upload-download/.forgejo/workflows/gpg.yml
index 49475d1..f2a6aea 100644
--- a/testdata/upload-download/.forgejo/workflows/gpg.yml
+++ b/testdata/upload-download/.forgejo/workflows/gpg.yml
@@ -5,89 +5,23 @@ on: [push]
 env:
   gpg_passphrase: admin1234
   gpg_private_key: |
-    -----BEGIN PGP PRIVATE KEY BLOCK-----
-    
-    lQWGBGRwcUEBDACzKYvl19Gqzdu2rwLx+Me+GvJkSemnvxdPvZhg+94uLmn+9oZp
-    jmaLA8Kbjb73zfitKOdJojRKuBwyNtP7iPt85nWeWwq4LKHCQUo81Uh4lzv/0N58
-    PNwFdRCHtD8MnhBRNv/kwccXyriikVbbi/dj+ISdKE7ueZ7SjgMFAa8JouiFldqZ
-    uU7FgxaFxQ5o5NqTJF4XOdZQakW2A5PhLDmEMQ/fPJ5gFXPBzu+yCvAo0G6QkcJ5
-    43mEOpJQwS79I1a8oS5txGiV0jP8PtyyAdIGuPW2B3oxmaNXllttYg2pnYR0Tr96
-    5uMr8B2wcBdWAewH1wP0QKcKol5vxYuSwCOkwIjXtSLWMpYjtaS4FcWObUhvJiDI
-    ypjLn1y2H6hW3oNT9W5nvaEgWqafdwBhF2BQJYcxAAmqIoIRY8k/JMLKuG6xdM4b
-    opCCo37syvcHU4jNvXu7vr/8w7Y5Wc/yIVQARcm65DAZ3OPmIYKp8BDUnDgweUZj
-    WaOWdYGB7+c8rDUAEQEAAf4HAwKdrS9IwGeeff9kQReq6FHd6Pp8KB807eqDBUAj
-    BnUUtIE3iK2HJ++GohBXZemzTu4zl62krIGwWcwoqfckv9dIkWioem9JMbL7q4Jm
-    6IChJ+EFvV6+I+C0lzM7L1lgKp6NZdcCnpfpSMrInVqzUqe4EbNaTDX5sN2IwdzR
-    8rorZcQSL/ncDXg7vAhBtiKArtfyIPsWoxvEcPJ42ZMY3qM5p8zFmzoJsDwO2MWc
-    K+UFrXJYZG43NoAOR5g7A+tHdcPLdQ/FT87tamyyULrVWnS6hDser4KlBN+Ez7bt
-    GACWa2bYee+fn0VssWGhGxeV6coICmNENPRFtiQYMhvIbdS22Np+7ym6+7XJ6P0g
-    f0iVi+3t3THXIJ84A/3uNnT2QG8BGmABsNzqK9TVMtHb4u8zLt6oG68WfnEumUo8
-    ycm4PPstDuhd623b/aaqvD51tDsZR4GRYruM+LeHKGi6UYMCUutoUvna1aRgnz8D
-    OCxz2emm+xsayz/+wo7UbD6CiTC9SPK0eAMYCghl0/wOcUFfp2hb8S7xzHg+HSEe
-    vSUjM0V1Qf6l2AfsaWy1Yy/0ZtRtBNyxVkSwsmbvvUif9lXZNYsOnMSOTV4rmYwo
-    QzKirhonkTkYv62GBRJZTYEVENrY9qUGrkYgCluGrVVNzFw2rTemvqX5IskMaaAZ
-    EW4tSlP0fWs4DNiQQutCmKO/0FVgl1uWy2kSDEqSTE3/kT8Y+9hlj/itM9n7J4DT
-    EqOhPZPit23OG5ahbGPUEODjXONmAlbwXmEUGf9KsnOaCRv2xYW9iT7fJrA7ivbV
-    /DVwIprkbA6ACuSg4Fia+5DibxXh/JfSU3R9o1ugspZ9wbE8ay5GPbKrqSTT1Jlu
-    JB0eY3HEDMEtVqbItedV2D7a/V5nfW3tZrIma0MyE7kAfJ3+ZqXWXww9ASLTUoZO
-    wT9VFj8ktF+4fjKIHoycR8IInl56T4xhoz9CTzaHOvk8GHZF4+FX+G2/IkFdinkb
-    Qbia26fGoS51o/rqzIHo4T15oBWXLSx7oHQhyyypzeRHmOKiStUI/rBnghl2Q8oJ
-    xE/PUtXJDPkJHwc6cSCTV81G2kRQVh4iZg9ixJsXvNdAlB1GGOJH3VDuxPPCRq3s
-    zJAPXOO28TwHyTipiw/wJ8Soyg4xpyoI2cp/CNpdo5f1mAruPr7XrdOHkl3obxRe
-    OCVCmyevgg1PX9uV4JncRtsiFje+RJFuLTjkMVZLmccnUNqi/CpA5dPmHkg+0uK1
-    1MVB+SJvjqr7ag+WbJuecuE84VD5Gr66CinOywfluRA+pLGdCIuxRZdTmgiVeh5S
-    bH3jhXBljzhFK2I9GJ0RVKDRsdu6iOrEW7QmVGVzdCBVc2VyIDx0ZXN0cGFzc3Bo
-    cmFzZUBleGFtcGxlLmNvbT6JAdQEEwEKAD4WIQTG5NstFF+myfSEwuHX3t0O/q5z
-    ogUCZHBxQQIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDX3t0O
-    /q5zolo2C/429RV2EhFG5EYKfLCd72ANLzUX9Kezk8tq3JDOYkRuqGF2y6HzuAcx
-    DYytRoyxTkCpxiuwPnxnU76cSSxn5+UZD+0sa5OGZYMtrCVSd56dXQkK0drf+RUo
-    apFLC6ufWmHox74ZIuTyPLj4YlsbSU3mE8CqVWY4Svk5W920wZDS7lrHSkXtKqh2
-    QtE/7/mTXCxu1HNqfck5ROIbA0MTKX2FG+3gujjJcZBEI8nkIdvI0XouOHXLZLKq
-    kh8//w1XsQeielOXO/+pQyT3lSwcZry4F112S4bMO+R12uWO6Hxwe9LoQb3gDmO5
-    H9LsssdpHC+bhJnTURGixiMuyzjFSmfVzzgU2YeP69R+GHxLMwMAo/a89eWFxiZI
-    6jMOx7TgYC9fg+Z8weTBq8fy8E5tT/LJm2VrBm3vuTgC4MePdBDy+AuEPyt3J2fX
-    1KS2vNlASeh6ONhMk+BMVWG0KWs3GVyF2DcXUCTX1xVI9uT+eJSR7UPJ+kRnIfO0
-    RzxL30Qxvw6dBYYEZHBxQQEMAMDLFiDTpnqsjH9li97yBOdG3SOu9EttdQXXopdh
-    EPJDxDCBHqfZvfjHuA5gfIP8bghQsXYCnn5k6dHZHdkJ9LfJTj8Wyh2cumhxPO2e
-    wbOmhQgLC54hmi0s64tj9GxM95aZk8umkTdXt+F9a4WihHGlgeCdpq+B6EQodDCU
-    ysJgnlCUGgjK/ptl4PhQtsgXk/mw0oOQukoulFFkfdlLEhWYNMz0/5oAMdGLa//W
-    8cjK2E5UN3/1PFF1nvzsHca/fGb1JvUwgrTjeJC4H10Vo4KvmYkpb943auoGJEJU
-    QbM/A7cDQvzB1OD/UpG6vYmarXCjGe2ZrJs+RI+bXMXLfsdCveLo1DPhpF7hLD+t
-    F2NI9oM/cEXuQBwl3mLOjFOn0Q1jXDD0uyzEJN7DKlnITyBV87hv2+hMGftnQwmX
-    iXw8rkBeaDLl4ShG3MLCr8KpcvtgtVf9ceZxO6K0CGTj+VSfKQ34HrWEoNzNoRoM
-    5dSPK6YXNRL2JizVRrAkVoRCzwARAQAB/gcDAqMHMJr6Gorz/9bZTyXQGO/oXkN8
-    D+G3Gn0n0iAmsH1nBo1qo61JosRAhhO+Z286F33tS/TqcblQVCsgPYFN93qX1yoB
-    RON619o3s+mF9PtSLvbUDdUa04eLarhH3RoCkkpoh+3df0xw+Jtpx2+eZibo32vb
-    U0e9lIO9Kv1I11Y2xSymFTzO+hK7IKYAvP9uzYty/r0rcgotJHr4B+k5jCQHXZhW
-    u0/68b7Y/JOUxKSag5r3PyyDWyJibRGi2ILwKogL5D4YdAtZYUNemmK9Is31NIs/
-    6jWHedOuRsBlM46NwwJs8ybtqy0TLDQhfrn2jUY/U+BMWSV4u8Ra33PaOyqv/EeN
-    hbySg2DTVnAlxzdw/z7oDPROtW1FzdFPVvOAUYOGuzlEhVAVzdhX9EfBahMIy7/B
-    sSlKoFOCMOngsnFrmxAMbUW49ZoTRzAunTVFNgqQJZLHmzPiyyierNP5FzjG+wO+
-    lprurp8RXFQ2KQ5hoF8Mw+F4V+mP+RAtO5P05rcp/PJafwdvxS03LZZchB3hRWQi
-    pGBum37nxN4ztbduUwWk+DKgB1pkPthF+i2cKlBgNzL/bfbmJoiIZghUKIgCZoXp
-    3PRwa2DM4CoFoC5FuhFV50CpqbrVeZAAK2Q3InphbdWZb5os9YqFfteLzk316zCj
-    vqftiZ4C5WPqMtesLGSeXNOna8vm5AOzt8qohmrLhdoONxBqf3sbykyzU567AWtm
-    P02u1JWQgGJnsRO+3j441VSK5SSmolCdDP+LspfZPCRZel+pBwlTJ6IpuFxB7zj1
-    UpkfT6r//bVfriwe6rFZ0VI3BfefJLrCIrgI0V/IFu1rjcciNV1PXwAdJNNhN3X4
-    4zPktSVR8u/Nz8jNgdSgXBYMkuv+QTjvzBvCMu5tP7ufXVXG6jAEJHeUh+633HGJ
-    o6NTsOZFhYwLmwTh4CBplt7bclsysOQGgo3SWHO3axCWrRX9uNVq0uIKjl3CHkqW
-    3dbQzFlY3raWT9q19g3cuiA8BZqh/NswIQDrOFS4pGrbTQFWY0zQZqFlHEyVCgwb
-    TtbcpjOBy3O2fsbFvepYDbcTYbmcacZSZFtTMiQGt3Ga+TeGsO+VIUzNgmpLkyWS
-    1QQjvqNKZnKWT6f4A7Lbj1OZqG/v4540jmOxShcHrz2Klwdrra6Ie7yERYmyPMZJ
-    98r2BFk04QaYK7r9xy7hJGBDmwT0VOcJXDAVA3HJJHGltnNKke2vP95JLmyahORP
-    efEsi0UPsQqkCS7iWV9ucUtKEnYzoHFSeSXU64+Cme6T+7FxJ9E2f5Ep88nz7ucg
-    EwgSiWsdqzEjntq5MAr6rSSk8ZKPzRbR61exuf7tWRa1iQG8BBgBCgAmFiEExuTb
-    LRRfpsn0hMLh197dDv6uc6IFAmRwcUECGwwFCQPCZwAACgkQ197dDv6uc6K7qQv/
-    brSaC5ICGKIpzsIf6lIp6Wrn7smsGh9BI+dH19prXQ5lT6Iv+IFZmNiDGXtVzOOK
-    Y8VgqwJmf/XwjgH2dod3X61ts3krtnZ2znCgrz08NRxG4G9ok8Fa5fLCrZBWi7UU
-    4ZH63rS9optmqEMzwCwQ94U0glU8C9Hc44MVCSrrrD2+/H/PTFVr37iwBugZsDq4
-    4gUTyGBYumnzTVyi2ZbJn89Amd8fl280QWSkdebmljnk4OjlTZbXkRGiIu65ggr9
-    ikg11TRlPD0L9NTo8w2OtjoYXr50xL1odyNlz6RKcQlX80EjKMXvVxNE32J4JCBj
-    tHrqiTDCs1bdXTh2xCvF0DatJMeUn3/WDn6UYjZzlZvZCOcjQLrPgJplJowLwd96
-    YaUfZ11WNAgNy8vZjUroMNyD2J+GsLr+QZOqFRP362+Juj5MqANXAuKEQ4qzs2Fv
-    /Z6cUYKuENmsNDY8ORG7ON95AFl5i0daP7+EoHDMb7+tyG54JxE4Szxhe4skRXXr
-    =Ze5I
-    -----END PGP PRIVATE KEY BLOCK-----
+     -----BEGIN PGP PRIVATE KEY BLOCK-----
+
+     lIYEaF6UehYJKwYBBAHaRw8BAQdAPKJ2JvwUyE7dy8bjVgBCjdRXSTw2BPl6wayP
+     o0WwhvT+BwMC8CxbenuzELD/Z524BTjgiXXgPS8rnRkSqww5Swa0d4mhtTn2w0pq
+     jRnHmVyLhh9n7e8GZaS9+8CFu3UWtkHgbRrzdyRg9KuFaW0ogcWA5bQmVGVzdCBV
+     c2VyIDx0ZXN0cGFzc3BocmFzZUBleGFtcGxlLmNvbT6IkwQTFgoAOxYhBF3PQjaj
+     rT/hLkdhdu9/tDIYmfSXBQJoXpR6AhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4H
+     AheAAAoJEO9/tDIYmfSX0zsBAJ4Tay/2jNMqye9RfiEn6B5e5IO+QymL52q6bF1z
+     ZNLDAP94yfwvG+7fL6W3XOTUr9unsCU9W0T0lAfFLmZY2WoeApyLBGhelHoSCisG
+     AQQBl1UBBQEBB0BMy3qqyiYPkalTZNUw/VSgHEOJF0Yi6fFi+DnEWtapKAMBCAf+
+     BwMCla2r1+brAiD/zuhRDXfJC1oRoEnDq/JgmsU14t6PNCPK6MPA+dmV3kCIVbjy
+     A97PMx6HBSTJZYdzGY8e2XdwzrVG4vbzH2yJ55LbawgFYIh4BBgWCgAgFiEEXc9C
+     NqOtP+EuR2F273+0MhiZ9JcFAmhelHoCGwwACgkQ73+0MhiZ9JeinQEAip+eryNU
+     T9X80S4YilMZg7djkmGfMJnEZiKYU8TEsFQBAN2D3PDAVNKs2ZOVp1GQMDse7sQ6
+     5C3faX2ZMchuKLwF
+     =RH4D
+     -----END PGP PRIVATE KEY BLOCK-----
 
 jobs:
   upload-gpg:

From 73598308778d1acd8c9fcdfe7f568ea02048700a Mon Sep 17 00:00:00 2001
From: sheik <sheik@noreply.code.forgejo.org>
Date: Sat, 28 Jun 2025 20:36:41 +0000
Subject: [PATCH 14/14] feat: use tea binary from system if available (#53)

As a proposal solution to this issue: https://code.forgejo.org/actions/forgejo-release/issues/51

We use the system installed tea binary if available or download it as it was done before if not.
The location of the binary is stored in a new variable `$TEA_BIN` which replaces the need for the `$ BIN_DIR` location.

I tested it on Alpine and Debian.

Co-authored-by: Rayan Mestiri <rayan.mestiri@gmail.com>
Co-authored-by: Rayan MESTIRI <rayan.mestiri@NLGRSSL600K.ratpsmart.local>
Reviewed-on: https://code.forgejo.org/actions/forgejo-release/pulls/53
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: sheik <sheik@noreply.code.forgejo.org>
Co-committed-by: sheik <sheik@noreply.code.forgejo.org>
---
 .forgejo/workflows/tests.yml     |  4 +++-
 forgejo-release.sh               | 16 +++++++++-------
 testdata/forgejo-release-test.sh | 16 +++++++++++++++-
 3 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/.forgejo/workflows/tests.yml b/.forgejo/workflows/tests.yml
index 5eba0cc..25bf909 100644
--- a/.forgejo/workflows/tests.yml
+++ b/.forgejo/workflows/tests.yml
@@ -7,4 +7,6 @@ jobs:
 
       - name: Unit tests of the supporting script forgejo-release.sh
         run: |
-          testdata/forgejo-release-test.sh test_maybe_sign_release
+          testdata/forgejo-release-test.sh test_system_tea_bin
+          testdata/forgejo-release-test.sh test_download_tea_bin
+          testdata/forgejo-release-test.sh test_maybe_sign_release
\ No newline at end of file
diff --git a/forgejo-release.sh b/forgejo-release.sh
index 38aa100..4a24998 100755
--- a/forgejo-release.sh
+++ b/forgejo-release.sh
@@ -12,7 +12,7 @@ if ${VERBOSE:-false}; then set -x; fi
 : ${DOWNLOAD_LATEST:=false}
 : ${TMP_DIR:=$(mktemp -d)}
 : ${GNUPGHOME:=$TMP_DIR}
-: ${BIN_DIR:=$TMP_DIR}
+: ${TEA_BIN:=$TMP_DIR/tea}
 : ${TEA_VERSION:=0.9.0}
 : ${OVERRIDE:=false}
 : ${HIDE_ARCHIVE_LINK:=false}
@@ -24,10 +24,12 @@ TAG_FILE="$TMP_DIR/tag$$.json"
 export GNUPGHOME
 
 setup_tea() {
-    if ! test -f "$BIN_DIR"/tea; then
+    if which tea 2>/dev/null; then
+        TEA_BIN=$(which tea)
+    else ! test -f $TEA_BIN;
         ARCH=$(dpkg --print-architecture)
-        curl -sL https://dl.gitea.io/tea/$TEA_VERSION/tea-$TEA_VERSION-linux-"$ARCH" >"$BIN_DIR"/tea
-        chmod +x "$BIN_DIR"/tea
+        curl -sL https://dl.gitea.io/tea/$TEA_VERSION/tea-$TEA_VERSION-linux-"$ARCH" >$TEA_BIN
+        chmod +x $TEA_BIN
     fi
 }
 
@@ -89,11 +91,11 @@ upload_release() {
         echo "Uploading as Stable"
     fi
     ensure_tag
-    if ! "$BIN_DIR"/tea release create "${assets[@]}" --repo $REPO --note "$RELEASENOTES" --tag "$TAG" --title "$TITLE" --draft ${releaseType} >&"$TMP_DIR"/tea.log; then
+    if ! $TEA_BIN release create "${assets[@]}" --repo $REPO --note "$RELEASENOTES" --tag "$TAG" --title "$TITLE" --draft ${releaseType} >&"$TMP_DIR"/tea.log; then
         if grep --quiet 'Unknown API Error: 500' "$TMP_DIR"/tea.log && grep --quiet services/release/release.go:194 "$TMP_DIR"/tea.log; then
             echo "workaround v1.20 race condition https://codeberg.org/forgejo/forgejo/issues/1370"
             sleep 10
-            "$BIN_DIR"/tea release create "${assets[@]}" --repo $REPO --note "$RELEASENOTES" --tag "$TAG" --title "$TITLE" --draft ${releaseType}
+            $TEA_BIN release create "${assets[@]}" --repo $REPO --note "$RELEASENOTES" --tag "$TAG" --title "$TITLE" --draft ${releaseType}
         else
             cat "$TMP_DIR"/tea.log
             return 1
@@ -153,7 +155,7 @@ upload() {
     setup_api
     setup_tea
     rm -f ~/.config/tea/config.yml
-    GITEA_SERVER_TOKEN=$TOKEN "$BIN_DIR"/tea login add --url $FORGEJO
+    GITEA_SERVER_TOKEN=$TOKEN $TEA_BIN login add --url $FORGEJO
     maybe_sign_release
     maybe_override
     upload_release
diff --git a/testdata/forgejo-release-test.sh b/testdata/forgejo-release-test.sh
index 156fb6b..7fe332b 100755
--- a/testdata/forgejo-release-test.sh
+++ b/testdata/forgejo-release-test.sh
@@ -4,13 +4,27 @@
 set -ex
 PS4='${BASH_SOURCE[0]}:$LINENO: ${FUNCNAME[0]}:  '
 
+test_system_tea_bin() {
+	SYSTEM_TEA_BIN=$TMP_DIR/tea
+	touch $SYSTEM_TEA_BIN && chmod +x $SYSTEM_TEA_BIN
+	export PATH=$TMP_DIR:$PATH
+    setup_tea
+	test $TEA_BIN == $SYSTEM_TEA_BIN
+}
+
+test_download_tea_bin() {
+    # assume tea is not installed on system
+    setup_tea
+    test $TEA_BIN == $TMP_DIR/tea
+}
+
 test_teardown() {
     setup_api
     api DELETE repos/$REPO/releases/tags/$TAG || true
     api DELETE repos/$REPO/tags/$TAG || true
     rm -fr dist/release
     setup_tea
-    $BIN_DIR/tea login delete $DOER || true
+    $TEA_BIN login delete $DOER || true
 }
 
 test_reset_repo() {