mirror of
https://github.com/block/buzz.git
synced 2026-10-29 21:41:33 +00:00
d99ad131f1
Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <wpfleger@block.xyz> Signed-off-by: Will Pfleger <wpfleger@squareup.com> Signed-off-by: Will Pfleger <wpfleger96@gmail.com> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@sprout-oss.stage.blox.sqprod.co> Co-authored-by: npub1fgdl5qqnh3k3f2xkqrvt7cujalhm623x4s7fdjdj5yrtp5fzjl9qrjpucw <4a1bfa0013bc6d14a8d600d8bf6392efefbd2a26ac3c96c9b2a106b0d12297ca@sprout-oss.stage.blox.sqprod.co> Co-authored-by: npub16v54tttfqacx9ycvc3k0ut0npj564ahcuajzy6qjvh57ntmsf4uq4806j2 <d32955ad69077062930cc46cfe2df30ca9aaf6f8e76422681265e9e9af704d78@sprout-oss.stage.blox.sqprod.co> Co-authored-by: Will Pfleger <wpfleger96@gmail.com>
47 lines
1.3 KiB
Markdown
47 lines
1.3 KiB
Markdown
# git-sign-nostr
|
|
|
|
NIP-GS signing program — signs git commits and tags with Nostr secp256k1 keys
|
|
using BIP-340 Schnorr signatures.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
# Configure git to use nostr signing
|
|
git config gpg.format x509
|
|
git config gpg.x509.program /path/to/git-sign-nostr
|
|
git config commit.gpgsign true
|
|
git config tag.gpgsign true
|
|
git config user.signingkey <hex-pubkey>
|
|
|
|
# Set the private key (env var)
|
|
export NOSTR_PRIVATE_KEY=<hex-or-nsec>
|
|
|
|
# Optional: NIP-OA owner attestation
|
|
export BUZZ_AUTH_TAG='["auth","<owner-pk>","<conditions>","<owner-sig>"]'
|
|
|
|
# Commits are now automatically signed
|
|
git commit -m "signed with nostr"
|
|
|
|
# Verify
|
|
git verify-commit HEAD
|
|
```
|
|
|
|
## Key Loading Priority
|
|
|
|
1. `NOSTR_PRIVATE_KEY` environment variable
|
|
2. `BUZZ_PRIVATE_KEY` environment variable
|
|
3. Keyfile at path from `git config nostr.keyfile`
|
|
|
|
Keys may be hex (64 chars) or NIP-19 bech32 (`nsec1...`).
|
|
|
|
## How It Works
|
|
|
|
Git invokes this program as a signing/verification backend:
|
|
|
|
- **Sign:** `git-sign-nostr --status-fd=2 -bsau <keyid>` — reads payload from
|
|
stdin, writes armored signature to stdout, status lines to fd 2 (stderr)
|
|
- **Verify:** `git-sign-nostr --status-fd=1 --verify <sigfile> -` — reads
|
|
payload from stdin, verifies signature from file, status lines to fd 1 (stdout)
|
|
|
|
See [NIP-GS](../../docs/nips/NIP-GS.md) for the full specification.
|