skarbiec signing

Invocation#

skarbiec signing setup <id> [--repo <dir>] [--github]
skarbiec signing status [--repo <dir>]
skarbiec signing unset [--repo <dir>]

Purpose#

Sign every git commit and tag with an SSH key the vault keeps, so forges show them as verified, without a private key file on disk or a GnuPG key to manage.

Required inputs and options#

• setup takes a key-pair item id, and --github to make the key one of the GitHub account's signing keys as well, through gh signed in with the admin:ssh_signing_key scope; every action takes --repo, a repository folder, for that repository's own configuration, else the user's global git configuration. git must be on PATH. POST /v1/operator/git-sign/setup takes id, repo and github, /status and /unset take repo; all act on the machine the API runs on and are never forwarded to a remote vault owner.

Output and state effects#

• With --github, setup first lists the GitHub account's signing keys and adds the item's public key titled `skarbiec <id>` unless it is already there. It then runs git config to set gpg.format ssh, user.signingkey to `key::` and the item's public key, and commit.gpgsign and tag.gpgsign true, journals git-sign-setup, and prints ok, item, scope, public_key, github (added, already_there and the new key's id, or null without --github), agent_holds_it (whether `ssh-add -L` lists the key) and load_it, the `skarbiec ssh add <id>` that puts the key in the agent git signs through. status prints scope, signing_key, the item keeping that key and agent_holds_it, or a null signing_key when git signs with nothing set by signing setup. unset removes those four settings, journals git-sign-unset and prints ok, item and scope. rotate --with ssh points the global user.signingkey at the new key when it named the rotated one, and says so under git_signing; rotate --with ssh --github-signing replaces the GitHub signing key too. Other forges show commits verified once the public key is added there as a signing key.

Refusals#

• Anything else exits 2 with `usage: signing setup <id> [--repo <dir>] [--github] | signing status [--repo <dir>] | signing unset [--repo <dir>]`. An item that is not a key-pair, or keeps no public key, is refused naming it. With --github, gh's refusal — not signed in, or without the admin:ssh_signing_key scope, which `gh auth refresh -s admin:ssh_signing_key` grants — is named with its words and git's configuration is left as it was. status refuses a signing key that is not an SSH public key line; unset refuses a configuration that signs with nothing signing setup set, or with a key no item here keeps, and leaves it as it is. git's own refusal — a folder that is not a repository, a configuration it cannot write — is named with its words.

Examples#

skarbiec signing setup laptop-ssh --github skarbiec ssh add laptop-ssh git commit -m 'signed by the vault key' git log --show-signature -1 skarbiec signing status