release-me-sh 0.10.12 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/plugins/git.sh +34 -3
- package/plugins/npm-post.sh +34 -3
package/package.json
CHANGED
package/plugins/git.sh
CHANGED
|
@@ -28,12 +28,41 @@ prepare() {
|
|
|
28
28
|
printf "%s" "${GPG_PASSPHRASE}" | gpg --quiet --batch --yes --pinentry-mode loopback --sign --local-user "${GPG_KEY_ID-}" --passphrase-fd 0 >/dev/null
|
|
29
29
|
log_verbose "Git GPG passphrase set"
|
|
30
30
|
fi
|
|
31
|
-
elif [ -z "${SSH_NO_SIGN-}" ] && [ -n "${
|
|
31
|
+
elif [ -z "${SSH_NO_SIGN-}" ] && [ -n "${SSH_PRIVATE_KEY-}" ] && [ -n "${SSH_PUBLIC_KEY-}" ]; then
|
|
32
|
+
eval "$(ssh-agent -s)"
|
|
33
|
+
|
|
34
|
+
SSH_PUBLIC_KEY_FILE=$(mktemp)
|
|
35
|
+
printf "%s" "${SSH_PUBLIC_KEY}" >>"${SSH_PUBLIC_KEY_FILE}"
|
|
36
|
+
|
|
32
37
|
git config --local commit.gpgsign true
|
|
33
|
-
git config --local user.signingkey "${
|
|
38
|
+
git config --local user.signingkey "${SSH_PUBLIC_KEY_FILE}"
|
|
34
39
|
git config --local tag.forceSignAnnotated true
|
|
35
40
|
git config --local gpg.format ssh
|
|
36
|
-
log_verbose "Git SSH sign is set"
|
|
41
|
+
log_verbose "Git SSH sign key is set"
|
|
42
|
+
|
|
43
|
+
if [ -n "${SSH_KEY_PASSPHRASE-}" ]; then
|
|
44
|
+
SSH_ASKPASS_FILE=$(mktemp)
|
|
45
|
+
chmod 0755 "${SSH_ASKPASS_FILE}"
|
|
46
|
+
printf "%s" "echo -n \"${SSH_KEY_PASSPHRASE}\"" >>"${SSH_ASKPASS_FILE}"
|
|
47
|
+
|
|
48
|
+
export SSH_ASKPASS="${SSH_ASKPASS_FILE}"
|
|
49
|
+
export SSH_ASKPASS_REQUIRE="force"
|
|
50
|
+
log_verbose "Git SSH passphrase set"
|
|
51
|
+
fi
|
|
52
|
+
|
|
53
|
+
if ! ssh-add -L | grep -q "${SSH_PUBLIC_KEY-}"; then
|
|
54
|
+
printf "%s" "${SSH_PRIVATE_KEY}" | base64 --decode | ssh-add -
|
|
55
|
+
log_verbose "Git SSH key import loaded"
|
|
56
|
+
else
|
|
57
|
+
log_verbose "Git SSH key import skipped"
|
|
58
|
+
fi
|
|
59
|
+
|
|
60
|
+
if [ -n "${SSH_KEY_PASSPHRASE-}" ]; then
|
|
61
|
+
rm -rf "${SSH_ASKPASS}"
|
|
62
|
+
unset SSH_ASKPASS
|
|
63
|
+
unset SSH_ASKPASS_REQUIRE
|
|
64
|
+
log_verbose "Git SSH key security cleanup"
|
|
65
|
+
fi
|
|
37
66
|
fi
|
|
38
67
|
}
|
|
39
68
|
|
|
@@ -66,6 +95,8 @@ cleanup() {
|
|
|
66
95
|
git config --local --unset user.signingkey "${SSH_PUB_KEY}"
|
|
67
96
|
git config --local --unset tag.forceSignAnnotated true
|
|
68
97
|
git config --local --unset gpg.format ssh
|
|
98
|
+
|
|
99
|
+
ssh-add -L | grep -F "${SSH_PUBLIC_KEY-}" | ssh-add -d -
|
|
69
100
|
log_verbose "Git SSH sign is unset"
|
|
70
101
|
fi
|
|
71
102
|
|
package/plugins/npm-post.sh
CHANGED
|
@@ -28,12 +28,41 @@ prepare() {
|
|
|
28
28
|
printf "%s" "${GPG_PASSPHRASE}" | gpg --quiet --batch --yes --pinentry-mode loopback --sign --local-user "${GPG_KEY_ID-}" --passphrase-fd 0 >/dev/null
|
|
29
29
|
log_verbose "Git GPG passphrase set"
|
|
30
30
|
fi
|
|
31
|
-
elif [ -z "${SSH_NO_SIGN-}" ] && [ -n "${
|
|
31
|
+
elif [ -z "${SSH_NO_SIGN-}" ] && [ -n "${SSH_PRIVATE_KEY-}" ] && [ -n "${SSH_PUBLIC_KEY-}" ]; then
|
|
32
|
+
eval "$(ssh-agent -s)"
|
|
33
|
+
|
|
34
|
+
SSH_PUBLIC_KEY_FILE=$(mtemp)
|
|
35
|
+
printf "%s" "${SSH_PUBLIC_KEY}" >>"${SSH_PUBLIC_KEY_FILE}"
|
|
36
|
+
|
|
32
37
|
git config --local commit.gpgsign true
|
|
33
|
-
git config --local user.signingkey "${
|
|
38
|
+
git config --local user.signingkey "${SSH_PUBLIC_KEY_FILE}"
|
|
34
39
|
git config --local tag.forceSignAnnotated true
|
|
35
40
|
git config --local gpg.format ssh
|
|
36
|
-
log_verbose "Git SSH sign is set"
|
|
41
|
+
log_verbose "Git SSH sign key is set"
|
|
42
|
+
|
|
43
|
+
if [ -n "${SSH_KEY_PASSPHRASE-}" ]; then
|
|
44
|
+
SSH_ASKPASS_FILE=$(mktemp)
|
|
45
|
+
chmod 0755 "${SSH_ASKPASS_FILE}"
|
|
46
|
+
printf "%s" "echo -n \"${SSH_KEY_PASSPHRASE}\"" >>"${SSH_ASKPASS_FILE}"
|
|
47
|
+
|
|
48
|
+
export SSH_ASKPASS="${SSH_ASKPASS_FILE}"
|
|
49
|
+
export SSH_ASKPASS_REQUIRE="force"
|
|
50
|
+
log_verbose "Git SSH passphrase set"
|
|
51
|
+
fi
|
|
52
|
+
|
|
53
|
+
if ! ssh-add -L | grep -q "${SSH_PUBLIC_KEY-}"; then
|
|
54
|
+
printf "%s" "${SSH_PRIVATE_KEY}" | base64 --decode | ssh-add -
|
|
55
|
+
log_verbose "Git SSH key import loaded"
|
|
56
|
+
else
|
|
57
|
+
log_verbose "Git SSH key import skipped"
|
|
58
|
+
fi
|
|
59
|
+
|
|
60
|
+
if [ -n "${SSH_KEY_PASSPHRASE-}" ]; then
|
|
61
|
+
rm -rf "${SSH_ASKPASS}"
|
|
62
|
+
unset SSH_ASKPASS
|
|
63
|
+
unset SSH_ASKPASS_REQUIRE
|
|
64
|
+
log_verbose "Git SSH key security cleanup"
|
|
65
|
+
fi
|
|
37
66
|
fi
|
|
38
67
|
}
|
|
39
68
|
|
|
@@ -66,6 +95,8 @@ cleanup() {
|
|
|
66
95
|
git config --local --unset user.signingkey "${SSH_PUB_KEY}"
|
|
67
96
|
git config --local --unset tag.forceSignAnnotated true
|
|
68
97
|
git config --local --unset gpg.format ssh
|
|
98
|
+
|
|
99
|
+
ssh-add -L | grep -F "${SSH_PUBLIC_KEY-}" | ssh-add -d -
|
|
69
100
|
log_verbose "Git SSH sign is unset"
|
|
70
101
|
fi
|
|
71
102
|
|