Merge pull request 'feature: move from gpg-git-commit-signing to ssh-signing' (#74) from feature/ssh-git-sign into main

Reviewed-on: #74

flake.lock

@@ -8,11 +8,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785627969,
-        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
+        "lastModified": 1787559586,
+        "narHash": "sha256-onL0VLf9vPllmT0H/OlURIU5r5t5WIEl7t4tVNKT0Nw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
+        "rev": "9d0d87172c374f89da73c1cfe6d81ae62feac1f1",
         "type": "github"
       },
       "original": {
@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787176219,
-        "narHash": "sha256-djoRr6jBpe35q/0JwAvXpFXg1Ktf+X54NU2RLR7wnHw=",
+        "lastModified": 1787797243,
+        "narHash": "sha256-8+Q7NOB7RPajRjA4pbCDLzqH+MTjnG9x6LUPLfL2joA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c53d643b3737e2fcd04e6cb3b3580ef50b2087a0",
+        "rev": "99c9ec63390f1d8c14d95d9e8b17cc29cfbd4e11",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1787135253,
-        "narHash": "sha256-RD2kNWCG+Bjo6h+JVjWVNntZs2GtRoeY2xHjts/FNkA=",
+        "lastModified": 1787900134,
+        "narHash": "sha256-VYXO0XZlgj06dxJZRhrD3WoSsvq/c7+/Akyoa22pefw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "ffb3c9b700e759be2ef13237c9d8f953b32a1e46",
+        "rev": "83199d0d373dd3ac2b9a1996b1d0263f76ab7a4c",
         "type": "github"
       },
       "original": {
@@ -66,11 +66,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1787151631,
-        "narHash": "sha256-EblMdrDFBFNNlUPm5zUQdh0j6gDx+OFQPv7LFE4B5AA=",
+        "lastModified": 1787862710,
+        "narHash": "sha256-dL1Tv7LekaTWUJxHRckjbupWczDdc3QOgRuVCM+WAvQ=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "d0d62a2b5027da689b4e8d5ee43f1cf83f2e975d",
+        "rev": "8c096abcf376137527c134da4ee210332b08ccc0",
         "type": "github"
       },
       "original": {
@@ -86,11 +86,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787234716,
-        "narHash": "sha256-O07tHqxugZ/XE/90kx/UCZ0YCbHSI88v2ct2ezuCKi4=",
+        "lastModified": 1788099672,
+        "narHash": "sha256-t4Rw5OeULK/WA2Jh9ja615sCs2AmvahkAUx/ymdf2YQ=",
         "owner": "noctalia-dev",
         "repo": "noctalia-shell",
-        "rev": "a064c063f204518619b8c032c944138a0349966b",
+        "rev": "d891007c022a3a1d4484495fe8b350a00deafae9",
         "type": "github"
       },
       "original": {

modules/home-manager/git.nix

@@ -1,17 +1,38 @@
-{ config, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:
 
+let
+  email = "aaron@0x29a.ch";
+
+  # public half of every machine's ~/.ssh/id_ed25519, each one verified as a
+  # signing key in gitea. the key a host signs with is picked up from the key
+  # file itself, this list only tells the local git which machines to trust
+  signingKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
+  ];
+in
 {
+  # gitea verifies signatures against the account keys, this teaches the local
+  # git the same trust so `git log --show-signature` resolves as well
+  xdg.configFile."git/allowed_signers".text =
+    lib.concatMapStrings (key: "${email} ${key}\n") signingKeys;
+
   programs.git = {
     enable = true;
     settings = {
       push = { autoSetupRemote = true; };
       user = {
         name  = "aaron";
-        email = "aaron@0x29a.ch";
+        email = email;
       };
+      gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
     };
     signing = {
-      key = "7A830180A05DAC59CDE43B0677D2F5DB48184456";
+      format = "ssh";
+      # point at the *public* key so ssh-keygen signs through the ssh agent
+      # instead of reading the passphrase protected private key from disk
+      key = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
+      signer = "${pkgs.openssh}/bin/ssh-keygen";
       signByDefault = true;
     };
   };

modules/nixos/gnupg.nix

@@ -4,12 +4,28 @@
   # enable gnupg agent
   programs.gnupg.agent = {
     enable = true;
-    enableSSHSupport = true;
-    pinentryPackage = pkgs.pinentry-curses;
+    # a graphical pinentry never grabs the tty, so a passphrase prompt can no
+    # longer take over a terminal that a coding agent is driving
+    pinentryPackage = pkgs.pinentry-qt;
+    settings = {
+      # keep the key unlocked for a full working day instead of 10 minutes,
+      # so signing commits asks at most once per session
+      default-cache-ttl = 86400;
+      max-cache-ttl = 86400;
+      # fail an unattended signature instead of blocking on a prompt forever
+      pinentry-timeout = 120;
+    };
   };
 
   environment.systemPackages = with pkgs; [
     gnupg
+    pinentry-qt
+    # fallback for sessions without a display, switch pinentryPackage to use it
     pinentry-curses
+    # prime the passphrase cache on demand, e.g. before an agent session
+    (writeShellScriptBin "gpg-unlock" ''
+      echo | ${config.programs.gnupg.package}/bin/gpg --clearsign --output /dev/null
+      echo "gpg key unlocked"
+    '')
   ];
 }