fix(ci): base64-encode the bot GPG key secret #147

2026-09-10T03:59:26Z

rootiest commented

2026-09-10 03:59:26 +00:00

Problem

The first real build-docs run after #145 merged failed at "Commit generated
docs":

gpg: keybox '/tmp/tmp.XXXXXXXXXX/pubring.kbx' created
gpg: CRC error; 606F91 - F2667B
gpg: read_block: read error: Invalid keyring
gpg: import from '[stdin]' failed: Invalid keyring
gpg: Total number processed: 0

The armored private key, piped through echo "$BOT_GPG_KEY" | gpg --import,
came out corrupted — something in the secret/env round-trip mangles the
embedded newlines of a multi-line secret value.

Fix

Regenerated the bot's GPG key (the old one is unrecoverable — Gitea
secrets are write-only by design, and the only local copy was
deliberately wiped after the previous fix). New fingerprint:
CAA082C2F3467E1F7217AD492075C120312D23F4.
CI_GPG_PRIVATE_KEY now stores the key base64-encoded — a single
line, immune to whatever was mangling real newlines.
Workflow decodes with base64 -d before gpg --import.

Verified end-to-end via workflow_dispatch on this branch before opening
this PR: Commit generated docs succeeded and pushed a real signed commit
(ecfcea5), confirmed via the commit verification API —
verified: true, reason: "fishconfig-bot / 2075C120312D23F4".

## Problem The first real `build-docs` run after #145 merged failed at "Commit generated docs": ``` gpg: keybox '/tmp/tmp.XXXXXXXXXX/pubring.kbx' created gpg: CRC error; 606F91 - F2667B gpg: read_block: read error: Invalid keyring gpg: import from '[stdin]' failed: Invalid keyring gpg: Total number processed: 0 ``` The armored private key, piped through `echo "$BOT_GPG_KEY" | gpg --import`, came out corrupted — something in the secret/env round-trip mangles the embedded newlines of a multi-line secret value. ## Fix - Regenerated the bot's GPG key (the old one is unrecoverable — Gitea secrets are write-only by design, and the only local copy was deliberately wiped after the previous fix). New fingerprint: `CAA082C2F3467E1F7217AD492075C120312D23F4`. - `CI_GPG_PRIVATE_KEY` now stores the key **base64-encoded** — a single line, immune to whatever was mangling real newlines. - Workflow decodes with `base64 -d` before `gpg --import`. Verified end-to-end via `workflow_dispatch` on this branch before opening this PR: `Commit generated docs` succeeded and pushed a real signed commit (`ecfcea5`), confirmed via the commit verification API — `verified: true, reason: "fishconfig-bot / 2075C120312D23F4"`.

rootiest added 2 commits 2026-09-10 03:59:27 +00:00

fix(ci): base64-encode the bot GPG key secret 4da176d507

Raw multi-line armored key piped through 'echo | gpg --import' came out
CRC-corrupted (Invalid keyring) on the first real run -- something in the
secret/env round-trip mangles embedded newlines. Regenerated the bot key
(old one is unrecoverable, secrets are write-only) and store it
base64-encoded, decoded with base64 -d before import.

chore(docs): regenerate manual, man page, and component registry ecfcea5106

rootiest added the Area/CI Kind/Bug labels 2026-09-10 03:59:39 +00:00

rootiest merged commit 679a703ab2 into main

2026-09-10 04:00:26 +00:00

rootiest deleted branch fix/ci-gpg-key-base64

2026-09-10 04:00:27 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: rootiest/fish-config#147