Christoph Görn 42614b036b

ci: 🔒️ add cosign-keygen.sh producing SOPS-encrypted k8s Secret ...

scripts/cosign-keygen.sh generates a cosign keypair and emits a
SOPS-encrypted Kubernetes Secret manifest containing the private key
and password. Defenses:

- Keypair is generated inside /dev/shm (tmpfs) when available; falls
  back to /tmp with shred-on-exit. Trap fires on EXIT/INT/TERM/HUP.
- Password read with `read -rs` (no terminal echo). Minimum 12 chars.
  Unset immediately after the Secret YAML is built.
- The private key + password are SOPS-encrypted in place via
  --encrypted-regex; the public key remains plaintext (intended for
  commit alongside the encrypted Secret).
- Neither cosign nor sops output keys on success paths; `set -x` is
  never enabled.
- Refuses to overwrite an existing output file.

Companion changes to keep accidental secret leakage out of git:
- .gitignore: ignore secrets/* by default, allow only *.enc.yaml,
  *.enc.yml, and cosign.pub through.
- secrets/.gitkeep: anchor the directory so the gitignore rules apply
  to a real path.

Pairs with the conditional cosign sign step in .forgejo/workflows/release.yml.

Refs forgejo-mcp-51l.

2026-05-24 12:43:03 +02:00

0 lines

Text

Raw Permalink Blame History