mirror of
https://github.com/Felitendo/Tanken.git
synced 2026-11-01 17:03:25 +01:00
71 lines
2.8 KiB
Bash
Executable File
71 lines
2.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# SessionStart hook: import the GPG signing key from a secret and configure git to
|
|
# sign commits, so commits made during remote sessions show up as "Verified" on GitHub.
|
|
#
|
|
# Required secret (set in the remote environment): GPG_PRIVATE_KEY (armored private key block)
|
|
# Optional secret: GPG_PASSPHRASE (only if the key has one)
|
|
#
|
|
# Safe to run repeatedly. Does nothing (and never fails the session) when no key is present
|
|
# or when running outside the remote environment.
|
|
set -euo pipefail
|
|
|
|
# Always pin the git identity first, before any early exit below. Otherwise sessions without a
|
|
# GPG key (or outside the remote env) keep the container's default git config, which makes commits
|
|
# show up as authored/committed by "Claude". This must run unconditionally in every session.
|
|
git config --global user.name "Felitendo"
|
|
git config --global user.email "felitendoyt@gmail.com"
|
|
|
|
# Only relevant in the remote (Claude Code on the web) environment; locally you use your own key.
|
|
if [ "${CLAUDE_CODE_REMOTE:-}" != "true" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
# Without a key there is nothing to do — skip quietly instead of erroring.
|
|
if [ -z "${GPG_PRIVATE_KEY:-}" ]; then
|
|
echo "session-start: GPG_PRIVATE_KEY not set — skipping commit-signing setup." >&2
|
|
exit 0
|
|
fi
|
|
|
|
export GNUPGHOME="${GNUPGHOME:-$HOME/.gnupg}"
|
|
mkdir -p "$GNUPGHOME"
|
|
chmod 700 "$GNUPGHOME"
|
|
|
|
# Import the private key (idempotent — re-importing is a no-op).
|
|
printf '%s\n' "$GPG_PRIVATE_KEY" | gpg --batch --import >&2 2>&1 || {
|
|
echo "session-start: gpg import failed." >&2
|
|
exit 0
|
|
}
|
|
|
|
# Determine the signing key id (first secret key).
|
|
KEYID="$(gpg --list-secret-keys --keyid-format=long --with-colons | awk -F: '/^sec:/{print $5; exit}')"
|
|
if [ -z "$KEYID" ]; then
|
|
echo "session-start: no secret key found after import — skipping." >&2
|
|
exit 0
|
|
fi
|
|
|
|
# Git identity + signing config (global so it applies to every repo in the session).
|
|
git config --global user.name "Felitendo"
|
|
git config --global user.email "felitendoyt@gmail.com"
|
|
git config --global user.signingkey "$KEYID"
|
|
git config --global commit.gpgsign true
|
|
git config --global tag.gpgsign true
|
|
|
|
if [ -n "${GPG_PASSPHRASE:-}" ]; then
|
|
# Enable non-interactive (loopback) signing and feed the passphrase via a wrapper.
|
|
echo "allow-loopback-pinentry" >> "$GNUPGHOME/gpg-agent.conf"
|
|
gpgconf --reload gpg-agent >/dev/null 2>&1 || true
|
|
printf '%s' "$GPG_PASSPHRASE" > "$GNUPGHOME/.passphrase"
|
|
chmod 600 "$GNUPGHOME/.passphrase"
|
|
cat > "$GNUPGHOME/git-gpg-sign.sh" <<WRAP
|
|
#!/bin/bash
|
|
exec gpg --batch --pinentry-mode loopback --passphrase-file "$GNUPGHOME/.passphrase" "\$@"
|
|
WRAP
|
|
chmod 700 "$GNUPGHOME/git-gpg-sign.sh"
|
|
git config --global gpg.program "$GNUPGHOME/git-gpg-sign.sh"
|
|
else
|
|
git config --global gpg.program gpg
|
|
fi
|
|
|
|
echo "session-start: commit signing configured with key $KEYID." >&2
|
|
exit 0
|