aaron/nixconfig
1
1
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feature: move from gpg-git-commit-signing to ssh-signing #74

Merged
aaron merged 2 commits from feature/ssh-git-sign into main 2026-09-05 15:46:55 +02:00
Conversation 0 Commits 2 Files Changed 2
+14 -9
1 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 1b9b584729 - Show all commits
modules/home-manager/git.nix
+14 -9
View File
@@ -1,16 +1,21 @@
{ config, pkgs, inputs, ... }: { config, lib, pkgs, inputs, ... }:
let let
# public half of ~/.ssh/id_ed25519, registered and verified as a signing key email = "aaron@0x29a.ch";
# in gitea
signingKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"; # public half of every machine's ~/.ssh/id_ed25519, each one verified as a
# signing key in gitea. the key a host signs with is picked up from the key
# file itself, this list only tells the local git which machines to trust
signingKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
];
in in
{ {
# gitea verifies signatures against the account key, this teaches the local # gitea verifies signatures against the account keys, this teaches the local
# git the same trust so `git log --show-signature` resolves as well # git the same trust so `git log --show-signature` resolves as well
xdg.configFile."git/allowed_signers".text = '' xdg.configFile."git/allowed_signers".text =
aaron@0x29a.ch ${signingKey} lib.concatMapStrings (key: "${email} ${key}\n") signingKeys;
'';
programs.git = { programs.git = {
enable = true; enable = true;
@@ -18,7 +23,7 @@ in
push = { autoSetupRemote = true; }; push = { autoSetupRemote = true; };
user = { user = {
name = "aaron"; name = "aaron";
email = "aaron@0x29a.ch"; email = email;
}; };
gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers"; gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
}; };