Skip to content

Getting GPG info from gh & GitHub #9

Open

Description

@ChristopherA

@namcios,

You might find these code snippets useful:

#!/bin/bash

if [[ $(command -v gh) == "" ]]; then

    printf "No \`gh\` Installed!\n"
    brew install gh
    printf "Installed \`gh\`.\n"
fi

if !(gh auth status --hostname "github.com" > /dev/null 2>&1); then
    printf "You are not logged into \`gh\`!\n"
    printf "Authenticate gh with GitHub using the Web and set ssh as default.\n"
    gh auth login
    printf "Logged into GitHub.\n"
fi


# Get the GitHub User Name from GitHub's `gh` cli config files
My_GitHub_User=$(cat <~/.config/gh/hosts.yml | grep -A0 user: | cut -d: -f2 | tr -d ' "')

printf "My_GitHub_User:\t$My_GitHub_User\t✅\n"

## Setup gnupg

## install gnupg if it is not already instealled
if [[ $(command -v gpg) == "" ]]; then
    printf "No GPG Installed!\n"
    brew install gpg2 pinentry-mac
    printf "Installing gpg & pinentry-mac\n"
fi


My_GPG_Key=$(curl https://github.com/$My_GitHub_User.gpg 2>/dev/null)
  if [ -z "$My_GPG_Key" ] ; then
    script_exit "ERROR: Unable to find $My_GPG_Key from https://github.com/$My_GitHub_User.gpg!\n" 1
  else
    printf "My_GPG_Key:\tRETREIVED\t✅\n"
  fi

export GPG_KEY=$My_GPG_Key

## Get GPG Fingerprint from $My_GPG_Key
# For instance https://github.com/ChristopherA.gpg
# $My_GPG_Key would equal "FDFE14A54ECB30FC5D2274EFF8D36C91357405ED"


My_GPG_KEY_Fingerprint=`echo $My_GPG_Key 2>/dev/null | gpg --with-colons --import-options show-only --import --fingerprint 2>/dev/null | awk -F: '$1 == "fpr" {print $10}' | head -1`

printf "My_GPG_KEY_Fingerprint:\t$My_GPG_Key_Fingerprint\t✅\n"

Activity

  1. namcios commented on Aug 17, 2021

    @namcios
    Collaborator
  2. namcios commented on Aug 17, 2021

    @namcios
    Collaborator

    @ChristopherA currently in the script the user has to upload their public key block to github before being able to sign commits. Is there a way to do that for them, in the script? Otherwise I'm not sure I understand why I would want to grab their GPG key from github in the script if it wouldn't be there yet?

  3. ChristopherA commented on Aug 17, 2021

    @ChristopherA
    ContributorAuthor

    A few different thoughts here.

    If they already have a GPG key, you don't want to create a new one. You can download the key to the .gnupg folder and ask the user for the private key file.

    I do presume that there is some way to upload a new gpg key, as gh does upload the ssh key it creates for you. Fortunately to do that the auth should be is available from gh as they have to have a token that is scoped to add that ssh public key.

    You can also use this test at a different point in the process, which is to confirm that the GPG key is posted AND is the correct key. You will not get recognition that your posted commit is valid unless the commit is signed AND the matches the email address in the public key.

  4. namcios commented on Aug 17, 2021

    @namcios
    Collaborator

    Got it. I presumed the script would mostly be for a fresh install and new keys. But those make sense and increase robustness. I'll work on it a bit today but mostly tomorrow. Will ping you if needed. Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions