diff options
Diffstat (limited to 'modules/scripts/gopass-ssh-load/script.sh')
| -rw-r--r-- | modules/scripts/gopass-ssh-load/script.sh | 39 |
1 files changed, 26 insertions, 13 deletions
diff --git a/modules/scripts/gopass-ssh-load/script.sh b/modules/scripts/gopass-ssh-load/script.sh index e8bc0ee..43c83b0 100644 --- a/modules/scripts/gopass-ssh-load/script.sh +++ b/modules/scripts/gopass-ssh-load/script.sh @@ -1,5 +1,12 @@ -export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)" +set -o errexit +set -o nounset +set -o pipefail +# Load SSH keys from gopass password store +export GNUPGHOME="${GNUPGHOME:-$HOME/.local/share/gnupg}" + +SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)" +export SSH_AUTH_SOCK if [ -z "$SSH_AUTH_SOCK" ] || [ ! -S "$SSH_AUTH_SOCK" ]; then echo "Error: SSH_AUTH_SOCK is not set or valid." >&2 exit 1 @@ -9,25 +16,31 @@ if ssh-add -l 2>/dev/null | grep -qE "(ED25519|RSA|ECDSA)"; then exit 0 fi -for key in github gitlab bitbucket codeberg sourcehut; do +# GOPASS_SSH_KEYS: space-separated list of gopass entry names under ssh/ +# e.g. GOPASS_SSH_KEYS="github gitlab work-server" +if [ -z "${GOPASS_SSH_KEYS:-}" ]; then + echo "Error: GOPASS_SSH_KEYS is not set. Example: GOPASS_SSH_KEYS=\"github gitlab\"" >&2 + exit 1 +fi + +# shellcheck disable=SC2086 +read -r -a keys <<< "$GOPASS_SSH_KEYS" + +for key in "${keys[@]}"; do if gopass cat "ssh/$key" > /dev/null 2>&1; then tmpdir=$(mktemp -d) keyfile="$tmpdir/key" gopass cat "ssh/$key" > "$keyfile" 2>/dev/null chmod 600 "$keyfile" - if ! ssh-add "$keyfile" 2>/dev/null; then - passphrase=$(gopass cat "ssh/$key/passphrase" 2>/dev/null) - if [ -n "$passphrase" ]; then - tmpcopy=$(mktemp) - cp "$keyfile" "$tmpcopy" - chmod 600 "$tmpcopy" - if ssh-keygen -p -P "$passphrase" -N "" -f "$tmpcopy" 2>/dev/null; then - ssh-add "$tmpcopy" 2>/dev/null - fi - rm -f "$tmpcopy" - fi + passphrase=$(gopass cat "ssh/$key/passphrase" 2>/dev/null || true) + if [ -n "$passphrase" ]; then + ssh-keygen -p -P "$passphrase" -N "" -f "$keyfile" 2>/dev/null fi + + ssh-add "$keyfile" 2>/dev/null rm -rf "$tmpdir" + else + echo "Warning: no gopass entry ssh/$key" >&2 fi done |