]> git.scottworley.com Git - auto-upgrade-with-pinch/blob - overlays/keyedgpg.nix
a78062ffae92acf0a14ee88e3033ccdc0c232bfc
[auto-upgrade-with-pinch] / overlays / keyedgpg.nix
1 # Following the instructions at https://tribut.de/blog/git-commit-signatures-trusted-keys
2 # Use with git with -c gpg.program='keyedgpg /path/to/keyfile.asc'
3
4 self: super:
5 let
6 homelessGPG = super.writeShellScript "homeless-gpg" ''
7 set -eo pipefail
8
9 export GNUPGHOME=$(${self.coreutils}/bin/mktemp -d)
10 trap '${self.coreutils}/bin/rm -r "$GNUPGHOME"' EXIT
11 ${self.gnupg}/bin/gpg --no-default-keyring "$@"
12 '';
13 in {
14 keyedgpg = keyfiles: super.writeShellScript "keyed-gpg" ''
15 set -eo pipefail
16
17 keyring=$(${self.coreutils}/bin/mktemp)
18 cleanup() { ${self.coreutils}/bin/rm "$keyring"; }
19 trap cleanup EXIT
20 ${homelessGPG} --keyring="$keyring" --import ${self.lib.escapeShellArgs keyfiles}
21
22 trusted_key_args=()
23 while read keyid;do
24 trusted_key_args+=( --trusted-key "$keyid" )
25 done < <(
26 ${homelessGPG} --with-colons --show-keys ${self.lib.escapeShellArgs keyfiles} |
27 ${self.gawk}/bin/awk -F: '$1 == "pub" { print $5 }')
28
29 ${homelessGPG} --keyring="$keyring" "''${trusted_key_args[@]}" "$@"
30 '';
31 }