This is a bug I found by running make regress with test data outside of /tmp.
'got tag' always unveils the repository as read-only, but adding tags will
obviously require read-write permission.

ok?

diff 0f84e4996c5a10d8ffca30998a7c99883e142e9e /home/stsp/src/got
blob - e2b4927b8bb743bb45718b5c21b186f11b4f918a
file + got/got.c
--- got/got.c
+++ got/got.c
@@ -6154,7 +6154,7 @@ cmd_tag(int argc, char *argv[])
 			goto done;
 
 		if (tagmsg) {
-			error = apply_unveil(got_repo_get_path(repo), 1, NULL);
+			error = apply_unveil(got_repo_get_path(repo), 0, NULL);
 			if (error)
 				goto done;
 		}