fix(scripts): resolve the personal signing key from the repo and overwrite partial signatures - #3904
Open
MattDHill wants to merge 1 commit into
Open
fix(scripts): resolve the personal signing key from the repo and overwrite partial signatures#3904MattDHill wants to merge 1 commit into
MattDHill wants to merge 1 commit into
Conversation
…write partial signatures `cmd_sign` and `cmd_cosign` read `user.signingkey` after `enter_release_dir` has moved into the release staging directory, so a repo-local key is never seen and the global one is used. With a global SSH signing key that is a `.pub` path, and gpg aborts with "No secret key" after the first Start9 signature. Read the key from `$REPO_ROOT`, and skip the personal signature when that repo signs with SSH, which gpg cannot use. Pass `--yes` to the detach-sign calls so re-running `sign` or `cosign` after a partial failure overwrites the half-written `signatures/*.asc` instead of stopping at gpg's overwrite prompt. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cmd_signandcmd_cosignresolveuser.signingkeyafterenter_release_dirhascd'd into the release staging directory, so the repo-local key is never seen and the global one is used. With a global SSH signing key that is a.pubpath, and gpg aborts withNo secret keyafter writing the first Start9 signature. This happened cutting start-cli 2.0.0 today.$REPO_ROOT, and skip the personal signature when that repo signs with SSH (gpg.format = ssh), which gpg cannot use. The existing "skipping personal signature" warning covers that case.--yesto the detach-sign calls so re-runningsignorcosignafter a partial failure overwrites the half-writtensignatures/*.ascinstead of stopping at gpg's overwrite prompt.Verified by signing start-cli 2.0.0, start-tunnel 1.3.0 and start-registry 1.1.0 with the patched script.
🤖 Generated with Claude Code