scripts/cosign-keygen.sh generates a cosign keypair and emits a
SOPS-encrypted Kubernetes Secret manifest containing the private key
and password. Defenses:
- Keypair is generated inside /dev/shm (tmpfs) when available; falls
back to /tmp with shred-on-exit. Trap fires on EXIT/INT/TERM/HUP.
- Password read with `read -rs` (no terminal echo). Minimum 12 chars.
Unset immediately after the Secret YAML is built.
- The private key + password are SOPS-encrypted in place via
--encrypted-regex; the public key remains plaintext (intended for
commit alongside the encrypted Secret).
- Neither cosign nor sops output keys on success paths; `set -x` is
never enabled.
- Refuses to overwrite an existing output file.
Companion changes to keep accidental secret leakage out of git:
- .gitignore: ignore secrets/* by default, allow only *.enc.yaml,
*.enc.yml, and cosign.pub through.
- secrets/.gitkeep: anchor the directory so the gitignore rules apply
to a real path.
Pairs with the conditional cosign sign step in .forgejo/workflows/release.yml.
Refs forgejo-mcp-51l.
42614b036b