Git GPG Remote Sign

https://github.com/woss/git-gpg-remote-sign
Admin
A proof-of-concept tool for remotely signing Git commits and tags using GPG, allowing private keys...
Tokens:2,031
Snippets:9
Trust Score:8.2
License:GPL-3.0
Update:1 year ago
Show doc for...
Tokens:
Raw
### Basic Node.js Example

Source: https://github.com/woss/git-gpg-remote-sign/blob/main/apps/desktop/index.html

A simple Node.js script demonstrating basic functionality. This snippet is a placeholder and would typically involve Git and GPG command execution.

```javascript
console.log("Hello World!");
// Placeholder for Git and GPG operations
```

--------------------------------

### Test Repository Setup

Source: https://github.com/woss/git-gpg-remote-sign/blob/main/signer/cli/README.md

Commands to set up a test Git repository, initialize it, create a file, add it to staging, and make an initial commit. This is useful for testing Git functionalities.

```sh
cd ~
mkdir test-repo
cd test-repo
git init
echo $(date) > file.txt; git add . ; git commit -m "woss-$(date)"
```

--------------------------------

### Install Remote Signer Utility

Source: https://github.com/woss/git-gpg-remote-sign/blob/main/README.md

This bash script downloads the `remote_signer` executable from an IPFS URL, saves it to `/usr/local/bin`, and makes it executable. This utility is used by Git for remote signing operations.

```bash
sudo sh -c 'curl https://ipfs.anagolay.network/ipfs/bafybeigcptua5ztgeydvokh6tsz7noz2cvfd2boxfbolbdgdm7wsajcuom > /usr/local/bin/remote_signer && chmod +x /usr/local/bin/remote_signer'
```

--------------------------------

### Docker Compose for Remote Signer Server

Source: https://github.com/woss/git-gpg-remote-sign/blob/main/README.md

This YAML configuration defines a Docker Compose setup for the remote signer server. It specifies the Docker image to use, environment file for configuration, volume mounting for keys, and port mapping.

```yaml
version: "3"
services:
  server:
    image: woss/remote-signer-server
    env_file: ./.env
    volumes:
      - ./keys:/keys
    ports:
      - 3000:3000
```

--------------------------------

### Build and Run Commands

Source: https://github.com/woss/git-gpg-remote-sign/blob/main/signer/cli/README.md

Commands to build and run the project, including watch mode for development and specific build configurations for the signer.

```sh
pnpm watch
pnpm dev
pnpm build:signer -- --watch
```

--------------------------------

### Environment Variables for Git Remote Signer

Source: https://github.com/woss/git-gpg-remote-sign/blob/main/README.md

These bash commands set essential environment variables for configuring the Git remote signing process. `GIT_REMOTE_SIGN_URL` points to the running signer service, `GPG_SIGN_KEY` can optionally specify the GPG key ID, and `APPROVED_API_KEY` is a security token for the service.

```bash
# where your service is running
export GIT_REMOTE_SIGN_URL=https://your-service.com

# only set this if you don't want to add the git.user.signingKey
# variable or that somehow doesn't work
export GPG_SIGN_KEY=YOUR_FULL_LENGTH_KEY_ID

# be really careful where and how you store this. who ever has access to this can acceess your sever
export APPROVED_API_KEY=777da2f3-19a5-425c-b662-79747d0b390c
```

--------------------------------

### Git Configuration for Remote Signing

Source: https://github.com/woss/git-gpg-remote-sign/blob/main/README.md

This INI configuration modifies Git's settings to use the `remote_signer` utility for GPG operations. It specifies the `signingKey` (preferably full length), sets `gpg.program` to `remote_signer`, and enables `commit.gpgsign` and `tag.forceSignAnnotated` for automatic signing.

```ini
[user]
name = Daniel Maricic
email = daniel@woss.io
# signingKey = 7A6DB9962EF3128E # this is my main key, only last 16 chars

# this is my new full length testing key for p2p git signing, if this is not set GPG_SIGN_KEY will be used
signingKey = 3595E4B1EB3363FB7C4F78CC12F55F7513EB0FA4 
[gpg]
program = remote_signer
[tag]
forceSignAnnotated = true
[commit]
gpgsign = true
```

--------------------------------

### Git Commit Verification

Source: https://github.com/woss/git-gpg-remote-sign/blob/main/signer/cli/README.md

Demonstrates how to verify Git commits using `git verify-commit` and `git show` with signature options. These commands are crucial for ensuring the integrity and authenticity of commits.

```sh
git verify-commit --raw -v 33af8e1bd1a9e2231503042a65bc8a0ab557fe50
git show --show-signature
git log --show-signature
```

--------------------------------

### Debugging Git Trace Options

Source: https://github.com/woss/git-gpg-remote-sign/blob/main/README.md

This bash command enables detailed tracing for Git operations, which is crucial for debugging issues related to remote signing or other Git functionalities. Various `GIT_TRACE_*` variables can be set to control the level of detail in the logs.

```bash
# this is the most important one
export GIT_TRACE=true

# super super optional
export GIT_CURL_VERBOSE=true
export GIT_SSH_COMMAND="ssh -vvv"
export GIT_TRACE_PACK_ACCESS=true
export GIT_TRACE_PACKET=true
export GIT_TRACE_PACKFILE=true
export GIT_TRACE_PERFORMANCE=true
export GIT_TRACE_SETUP=true
export GIT_TRACE_SHALLOW=true
```
Tokens:
Raw