``` ~alice

$ rad inspect --sigrefs

```

Now let's clean the `heartwood` project:

``` ~alice

$ rad inspect --sigrefs

```

Note that Bob will be fetched again if we do not untrack his

    │   └── master

    └── rad

        ├── id

        └── sigrefs

z6Mkt67GdsW7715MEfRuP4pSZxJRJh6kj6Y48WRqVv4N1tRk

└── refs

    ├── heads

    │   └── master

    └── rad

        └── sigrefs

```

    │   └── master

    └── rad

        ├── id

        └── sigrefs

z6Mkt67GdsW7715MEfRuP4pSZxJRJh6kj6Y48WRqVv4N1tRk

└── refs

    ├── heads

    │   └── master

    └── rad

        └── sigrefs

z6Mkux1aUQD2voWWukVb5nNUR7thrHveQG4pDQua8nVhib7Z

└── refs

    ├── heads

    │   └── master

    └── rad

        └── sigrefs

```

    │   └── master

    └── rad

        ├── id

        └── sigrefs

```

    │   └── master

    └── rad

        ├── id

        └── sigrefs

z6Mkt67GdsW7715MEfRuP4pSZxJRJh6kj6Y48WRqVv4N1tRk

└── refs

    ├── heads

    │   └── master

    └── rad

        └── sigrefs

```

```

``` ~bob

$ rad sync --fetch rad:z42hL2jL4XNk6K8oHQaSWfMgCL7ji

✓ Fetching rad:z42hL2jL4XNk6K8oHQaSWfMgCL7ji from z6MknSL…StBU8Vi..

✓ Fetched repository from 1 seed(s)

    │   └── master

    └── rad

        ├── id

        └── sigrefs

z6Mkt67GdsW7715MEfRuP4pSZxJRJh6kj6Y48WRqVv4N1tRk

└── refs

    │   └── xyz.radicle.issue

    │       └── f12d512c51d30429f7916db038ae0360e2e938c2

    └── rad

        └── sigrefs

```

    │       └── b09b2aa0ee055671c811e9ad4ba73eed211ebaa3

    └── rad

        ├── id

        └── sigrefs

```

``` ~alice

$ rad inspect --sigrefs

```

And she can still list the project, without any worries:

✓ Fetching rad:z42hL2jL4XNk6K8oHQaSWfMgCL7ji from z6Mkt67…v4N1tRk..

✓ Fetched repository from 2 seed(s)

$ rad inspect --sigrefs

```

    │   └── master

    └── rad

        ├── id

        └── sigrefs

```

```

$ rad inspect --sigrefs

```

Or display the repository identity's payload and delegates:

    │       └── 696ec5508494692899337afe6713fe1796d0315c

    └── rad

        ├── id

        └── sigrefs

```

    │   └── master

    └── rad

        ├── id

        └── sigrefs

```

╭──────────────────────────────────────────────────────────────────────────────────────────────╮

│ ●   Node                      Address                      Status        Tip       Timestamp │

├──────────────────────────────────────────────────────────────────────────────────────────────┤

╰──────────────────────────────────────────────────────────────────────────────────────────────╯

```

╭─────────────────────────────────────────────────────────────────────────────────────────╮

│ ●   Node                      Address                      Status   Tip       Timestamp │

├─────────────────────────────────────────────────────────────────────────────────────────┤

╰─────────────────────────────────────────────────────────────────────────────────────────╯

```

use radicle::node::UserAgent;

use radicle::node::{address, Alias, ConnectOptions};

use radicle::rad;

use radicle::storage::{ReadRepository, RemoteRepository};

use radicle::Storage;

        ann.into().signed(self.signer()).into()

    }

        SignedRefsAt {

            at,

        }

    }

    let mut bob = Peer::with_storage("bob", [8, 8, 8, 8], storage_bob);

    let node_id = alice.id;

        node_id,

    );

    // Generate some refs for Bob under their own node_id.

    let node_id = bob.id;

    bob.init();

    bob.storage_mut()

    // Finish the 1st fetch.

    // Ensure the ref is in the storage and cache.

        carol.id(),

    );

    alice

        .database_mut()

                // be a separate notification on the identity COB itself.

                continue;

            }

            if let Some(rest) = r.strip_prefix(git::refname!("refs/heads/patches")) {

                if radicle::cob::ObjectId::from_str(rest.as_str()).is_ok() {

                    // Don't notify about patch branches, since we already get

    /// This error indicates that the operations are not being applied

    /// in causal order, which is a requirement for this CRDT.

    ///

    /// that hasn't happened yet.

    #[error("causal dependency {0:?} missing")]

    Missing(EntryId),

        self,

        working: &git::raw::Repository,

        signer: &G,

        let nid = signer.public_key();

        let stored_ref = git::refs::patch(&self.patch).with_namespace(nid.into());

        let working_ref = git::refs::workdir::patch_upstream(&self.patch);

    #[error("object `{1}` of type `{0}` was not found")]

    NotFound(TypeName, ObjectId),

    #[error("signed refs: {0}")]

    #[error("invalid or unknown embed URI: {0}")]

    EmbedUri(Uri),

    #[error(transparent)]

                changes,

            },

        )?;

        Ok(updated)

    }

                contents,

            },

        )?;

        Ok((*cob.id(), cob.object))

    }

        {

            Ok(_) => {

                cob::remove(self.repo, signer.public_key(), T::type_name(), id)?;

                Ok(())

            }

            Err(err) if err.code() == git::raw::ErrorCode::NotFound => Ok(()),

        use super::*;

        ///

        /// `refs/rad/id`

        ///

            Qualified::from_components(name::component!("rad"), name::component!("id"), None)

        });

        /// Where the project's signed references are stored.

        ///

        /// `refs/rad/sigrefs`

            IDENTITY_BRANCH.with_namespace(remote.into())

        }

        /// Get the branch where the `remote`'s signed references are

        /// stored.

        ///

#![allow(clippy::let_unit_value)]

use std::io;

use std::path::Path;

use std::str::FromStr;

    storage: S,

) -> Result<(RepoId, identity::Doc<Verified>, SignedRefs<Verified>), InitError> {

    // TODO: Better error when project id already exists in storage, but remote doesn't.

    let proj = Project::new(

        name.to_owned(),

        description.to_owned(),

        )

    })?;

    let doc = identity::Doc::initial(proj, delegate, visibility).verified()?;

    let url = git::Url::from(project.id);

        Ok(signed) => Ok((project.id, doc, signed)),

        Err(err) => {

            if let Err(e) = project.remove() {

fn init_configure<G>(

    repo: &git2::Repository,

    default_branch: &BranchName,

    url: &git::Url,

    signer: &G,

) -> Result<SignedRefs<Verified>, InitError>

where

    G: crypto::Signer,

{

    git::configure_repository(repo)?;

    git::configure_remote(repo, &REMOTE_NAME, url, &url.clone().with_namespace(*pk))?;

    git::push(

            &git::fmt::lit::refs_heads(default_branch).into(),

        )],

    )?;

    Ok(signed)

}

}

impl Remote<Unverified> {

        Ok(Remote { refs })

    }

    fn set_head(&self) -> Result<SetHead, RepositoryError>;

    /// Set the repository 'rad/id' to the canonical commit, agreed by quorum.

    fn set_identity_head(&self) -> Result<Oid, RepositoryError> {

        self.set_identity_head_to(head)?;

        Ok(head)

    }

    /// Set the repository 'rad/id' to the given commit.

    fn set_identity_head_to(&self, commit: Oid) -> Result<(), RepositoryError>;

    /// Set the user info of the Git repository.

/// Allows signing refs.

pub trait SignRepository {

    /// Sign the repository's refs under the `refs/rad/sigrefs` branch.

}

impl<T, S> ReadStorage for T

use crate::storage::refs;

use crate::storage::refs::{Refs, SignedRefs, SignedRefsAt};

use crate::storage::{

};

use crate::{git, node};

pub use crate::git::{

    ext, raw, refname, refspec, Oid, PatternStr, Qualified, RefError, RefString, UserInfo,

};

use super::refs::RefsAt;

use super::{RemoteId, RemoteRepository, ValidateRepository};

    fn identity_root(&self) -> Result<Oid, RepositoryError> {

        let oid = self.backend.refname_to_id(CANONICAL_IDENTITY.as_str())?;

            .last()

            .ok_or(RepositoryError::Doc(DocError::Missing))??;

    }

    fn identity_root_of(&self, remote: &RemoteId) -> Result<Oid, RepositoryError> {

    }

    fn canonical_identity_head(&self) -> Result<Oid, RepositoryError> {

        Ok(())

    }

    fn set_user(&self, info: &UserInfo) -> Result<(), Error> {

        let mut config = self.backend.config()?;

        config.set_str("user.name", &info.name())?;

}

impl SignRepository for Repository {

        let remote = signer.public_key();

        let mut refs = self.references_of(remote)?;

        // Don't sign the `rad/sigrefs` ref itself, and don't sign invalid OIDs.

        refs.retain(|name, oid| {

            name.as_refstr() != refs::SIGREFS_BRANCH.as_ref() && !oid.is_zero()

        });

        signed.save(self)?;

        Ok(signed)

    }

}

pub mod trailers {

    use std::str::FromStr;

    use crate::git;

    use crate::storage::refs::SIGREFS_BRANCH;

    use crate::storage::{ReadRepository, ReadStorage};

    use crate::test::fixtures;

    #[test]

        assert_eq!(

            refs,

        );

    }

        let mut rng = fastrand::Rng::new();

        let signer = MockSigner::new(&mut rng);

        let storage = Storage::open(tmp.path(), fixtures::user()).unwrap();

        let alice = *signer.public_key();

        let sig = git2::Signature::now(&alice.to_string(), "anonymous@radicle.xyz").unwrap();

        git::commit(

            &head,

            &git::RefString::try_from(format!("refs/remotes/{alice}/heads/master")).unwrap(),

            "Second commit",

            &sig,

        )

        .unwrap();

        // The signed refs doesn't contain the signature ref itself.

        let sigref = (*SIGREFS_BRANCH).to_ref_string();

use super::{RemoteId, Repository};

#[derive(Error, Debug)]

pub enum ObjectsError {

    fn sign_refs<G: crypto::Signer>(

        &self,

        signer: &G,

        // Since this is a draft store, we do not actually want to sign the refs.

        // Instead, we just return the existing signed refs.

        let remote = self.repo.remote(signer.public_key())?;

use crate::git::Oid;

use crate::profile::env;

use crate::storage;

pub use crate::git::refs::storage::*;

    Canonical(#[from] canonical::Error),

    #[error("invalid reference")]

    InvalidRef,

    #[error("invalid reference: {0}")]

    Ref(#[from] git::RefError),

    #[error(transparent)]

impl Refs {

    /// Verify the given signature on these refs, and return [`SignedRefs`] on success.

        self,

        signer: PublicKey,

        signature: Signature,

    ) -> Result<SignedRefs<Verified>, Error> {

    }

    /// Sign these refs with the given signer and return [`SignedRefs`].

    where

        G: Signer,

    {

        let msg = refs.canonical();

        let signature = signer.try_sign(&msg)?;

    }

    /// Get a particular ref.

}

impl SignedRefs<Unverified> {

        Self {

            refs,

            signature,

            _verified: PhantomData,

        }

    }

            Ok(()) => Ok(SignedRefs {

                refs: self.refs,

                signature: self.signature,

        }

    }

        let canonical = self.refs.canonical();

        }

    }

}

        let refs = repo.blob_at(oid, Path::new(REFS_BLOB_PATH))?;

        let signature = repo.blob_at(oid, Path::new(SIGNATURE_BLOB_PATH))?;

        let signature: crypto::Signature = signature.content().try_into()?;

    }

    /// Save the signed refs to disk.

        // N.b. if the signatures match then there are no updates

        let parent = match SignedRefsAt::load(*remote, repo)? {

            Some(SignedRefsAt { sigrefs, at }) if sigrefs.signature == self.signature => {

            }

            Some(SignedRefsAt { at, .. }) => Some(raw.find_commit(*at)?),

            None => None,

#[cfg(test)]

mod tests {

    use crypto::test::signer::MockSigner;

    use qcheck_macros::quickcheck;

    use storage::{git::transport, RemoteRepository, SignRepository, WriteStorage};

    #[quickcheck]

    fn prop_canonical_roundtrip(refs: Refs) {

        let encoded = refs.canonical();

    }

    #[test]

    // Test that a user's signed refs are tied to a specific RID, and they can't simply be

    // used in a different repository.

    //

        // Due to the verification, we get a validation error when trying to load Bob's remote.

        // The graft is not allowed.

    }

}

pub fn nonempty_storage(size: usize) -> MockStorage {

    let mut storage = gen::<MockStorage>(size);

    for _ in 0..size {

        storage.repos.insert(

            id,

            MockRepository {

                id,

                remotes: HashMap::new(),

            },

        );

    T::arbitrary(&mut gen)

}

    fn arbitrary(g: &mut qcheck::Gen) -> Self {

            Arbitrary::arbitrary(g);

        storage::Remotes::new(remotes)

    fn arbitrary(g: &mut qcheck::Gen) -> Self {

        let bytes: [u8; 64] = Arbitrary::arbitrary(g);

        let signature = crypto::Signature::from(bytes);

        let refs = Refs::arbitrary(g);

    }

}

    }

}

    fn arbitrary(g: &mut qcheck::Gen) -> Self {

        let refs = Refs::arbitrary(g);

        let signer = MockSigner::arbitrary(g);

        let signed = refs.signed(&signer).unwrap();

    }

}

    }

    fn identity_head_of(&self, _remote: &RemoteId) -> Result<Oid, git::ext::Error> {

    }

    fn identity_root(&self) -> Result<Oid, RepositoryError> {

    }

    fn identity_root_of(&self, _remote: &RemoteId) -> Result<Oid, RepositoryError> {

    }

    fn canonical_identity_head(&self) -> Result<Oid, RepositoryError> {

    }

    fn merge_base(&self, _left: &Oid, _right: &Oid) -> Result<Oid, git::ext::Error> {

        todo!()

    }

    fn set_user(&self, _info: &git::UserInfo) -> Result<(), Error> {

        todo!()

    }

    fn sign_refs<G: Signer>(

        &self,

        _signer: &G,

        todo!()

    }

}