Accept multiple signing keys

[auto-upgrade-with-pinch] / overlays / keyedgit.nix

diff --git a/overlays/keyedgit.nix b/overlays/keyedgit.nix
index bbc156bd2079d08d91f769cc95697f479b58e64e..a4465dcf493328d12f3b53b33b5f18ecfa8de3ff 100644 (file)
--- a/overlays/keyedgit.nix
+++ b/overlays/keyedgit.nix
@@ -1,28 +1,34 @@
 # Following the instructions at https://tribut.de/blog/git-commit-signatures-trusted-keys
 
 self: super: {
-  keyedgit = key:
+  keyedgit = keys:
     let
-      keyring = super.runCommand "keyedkeyring.gpg" {} ''
+      homelessGPG = super.writeShellScript "homeless-gpg" ''
         export GNUPGHOME=$(mktemp -d)
-        ${self.gnupg}/bin/gpg --no-default-keyring --keyring=$out --import ${key}
+        trap 'rm -r "$GNUPGHOME"' EXIT
+        ${self.gnupg}/bin/gpg "$@"
+      '';
+      keyring = super.runCommand "keyedkeyring.gpg" {} ''
+        ${homelessGPG} --no-default-keyring --keyring=$out --import ${keys}
+      '';
+      keyids = super.runCommand "keyids" {} ''
+        ${homelessGPG} --no-default-keyring --with-colons --show-keys ${keys} |
+          ${self.gawk}/bin/awk -F: 'prev == "pub" && $1 == "fpr" { print $10 } { prev = $1 }' > $out
+      '';
+      keyedGPG = super.writeShellScript "keyed-gpg" ''
+        trusted_key_args=()
+        while read keyid;do
+          trusted_key_args+=( --trusted-key "$keyid" )
+        done < ${keyids}
+        ${homelessGPG} --no-default-keyring --keyring=${keyring} "''${trusted_key_args[@]}" "$@"
       '';
-      keyedgpg = super.symlinkJoin {
-        name = "keyedgpg";
-        buildInputs = [ super.makeWrapper ];
-        paths = [ self.gnupg ];
-        postBuild = ''
-          wrapProgram "$out/bin/gpg" \
-            --add-flags '--no-default-keyring --keyring=${keyring}'
-        '';
-      };
     in super.symlinkJoin {
       name = "keyedgit";
       paths = [ self.git ];
       buildInputs = [ super.makeWrapper ];
       postBuild = ''
         wrapProgram "$out/bin/git" \
-          --add-flags '-c gpg.program=${keyedgpg}/bin/gpg'
+          --add-flags '-c gpg.program=${keyedGPG}'
       '';
     };
 }