@runuai/host 0.9.67 → 0.9.68
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/git-identity.ts +14 -2
- package/package.json +1 -1
package/lib/git-identity.ts
CHANGED
|
@@ -112,11 +112,22 @@ export async function setupTaskGitIdentity(
|
|
|
112
112
|
// The key's dependent signing config, applied as one unit with the key itself.
|
|
113
113
|
// Deliberately no URL rewrite: doing that here would override a connected
|
|
114
114
|
// user's gh HTTPS credential and make SSH mandatory again.
|
|
115
|
+
//
|
|
116
|
+
// allowed_signers rides along so verification works, not just signing:
|
|
117
|
+
// without gpg.ssh.allowedSignersFile, `git log --format=%G?` prints N ("no
|
|
118
|
+
// signature") for commits that ARE signed and GitHub-verified — git reports
|
|
119
|
+
// the absence of a verification RESULT as the absence of a signature, and a
|
|
120
|
+
// crew read "all 25 commits unsigned" off perfectly signed work (live
|
|
121
|
+
// 2026-08-26). The wildcard principal is deliberate: the task key is the
|
|
122
|
+
// container's only signer, and the identity email may not be configured yet
|
|
123
|
+
// when the key lands.
|
|
115
124
|
const SSH_SIGNING_CONFIG =
|
|
116
125
|
"/usr/bin/git config --global gpg.format ssh" +
|
|
117
126
|
" && /usr/bin/git config --global user.signingkey /home/node/.ssh/id_ed25519.pub" +
|
|
118
127
|
" && /usr/bin/git config --global commit.gpgsign true" +
|
|
119
|
-
" && /usr/bin/git config --global tag.gpgsign true"
|
|
128
|
+
" && /usr/bin/git config --global tag.gpgsign true" +
|
|
129
|
+
' && /usr/bin/printf \'* %s\\n\' "$(/bin/cat /home/node/.ssh/id_ed25519.pub)" > /home/node/.ssh/allowed_signers' +
|
|
130
|
+
" && /usr/bin/git config --global gpg.ssh.allowedSignersFile /home/node/.ssh/allowed_signers";
|
|
120
131
|
|
|
121
132
|
const SSH_TRANSPORT_CONFIG =
|
|
122
133
|
"/usr/bin/git config --global --unset-all 'url.https://github.com/.insteadOf' >/dev/null 2>&1 || true; " +
|
|
@@ -387,7 +398,8 @@ async function ensureTaskSshIdentityOnce(
|
|
|
387
398
|
|
|
388
399
|
const REMOVE_MANAGED_SSH_IDENTITY = [
|
|
389
400
|
"set -eu",
|
|
390
|
-
"/usr/bin/rm -f -- /home/node/.ssh/id_ed25519 /home/node/.ssh/id_ed25519.pub",
|
|
401
|
+
"/usr/bin/rm -f -- /home/node/.ssh/id_ed25519 /home/node/.ssh/id_ed25519.pub /home/node/.ssh/allowed_signers",
|
|
402
|
+
"/usr/bin/git config --global --unset-all gpg.ssh.allowedSignersFile >/dev/null 2>&1 || true",
|
|
391
403
|
"/usr/bin/git config --global --unset-all user.signingkey >/dev/null 2>&1 || true",
|
|
392
404
|
"/usr/bin/git config --global --unset-all commit.gpgsign >/dev/null 2>&1 || true",
|
|
393
405
|
"/usr/bin/git config --global --unset-all tag.gpgsign >/dev/null 2>&1 || true",
|