commit signing hell

internal/agents/mergein.go

@@ -455,7 +455,7 @@ func (m *Manager) squashAndClose(ctx context.Context, taskID, login string) erro
 		"GIT_COMMITTER_NAME=" + user.GitName,
 		"GIT_COMMITTER_EMAIL=" + user.GitEmail,
 	}
-	commit, err := git.SquashCommit(project.RepoPath, task.WorktreePath, project.DefaultBranch, squashMessage(task.MergeTitle, coAuthors), env)
+	commit, err := git.SquashCommit(project.RepoPath, task.WorktreePath, project.DefaultBranch, squashMessage(task.MergeTitle, coAuthors), env, m.signer(ctx, user))
 	if err != nil {
 		return err
 	}

internal/agents/mergemain.go

@@ -123,7 +123,7 @@ func (m *Manager) pushToMain(ctx context.Context, l *live, task api.Task, projec
 		"GIT_COMMITTER_NAME=" + user.GitName,
 		"GIT_COMMITTER_EMAIL=" + user.GitEmail,
 	}
-	commit, err := git.SquashCommit(project.RepoPath, l.dir, project.DefaultBranch, squashMessage(title, coAuthors), env)
+	commit, err := git.SquashCommit(project.RepoPath, l.dir, project.DefaultBranch, squashMessage(title, coAuthors), env, m.signer(ctx, user))
 	conflict := &git.ConflictError{}
 	if errors.As(err, &conflict) {
 		return "", fmt.Errorf("%w; run `git merge --no-ff --no-commit %s`, resolve them, and call merge_to_main again", err, project.DefaultBranch)

internal/agents/sign.go

@@ -0,0 +1,52 @@
+package agents
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"g.fc.run/ai/byre/internal/api"
+	"g.fc.run/ai/byre/internal/clients"
+)
+
+const signTimeout = 2 * time.Minute
+
+func (m *Manager) signer(ctx context.Context, user api.User) func(payload []byte) ([]byte, error) {
+	return func(payload []byte) ([]byte, error) {
+		mine := []clients.Client{}
+		for _, c := range m.clients.List() {
+			if c.Login == user.Login {
+				mine = append(mine, c)
+			}
+		}
+		if len(mine) == 0 {
+			return nil, fmt.Errorf("commits are signed on %s's Mac, and none of theirs is connected", user.Login)
+		}
+		sort.SliceStable(mine, func(i, j int) bool {
+			a, b := mine[i].LastActionAt, mine[j].LastActionAt
+			return a != nil && (b == nil || a.After(*b))
+		})
+		client := mine[0]
+
+		ident := fmt.Sprintf("%s <%s>", user.GitName, user.GitEmail)
+		ms := int(signTimeout.Milliseconds())
+		cctx, cancel := context.WithTimeout(ctx, signTimeout+replyGrace)
+		defer cancel()
+		reply, err := m.clients.Call(cctx, client.ID, api.ClientRequest{Op: api.Sign, Data: &payload, Ident: &ident, TimeoutMs: &ms})
+		if err != nil {
+			return nil, err
+		}
+		if reply.ExitCode == nil || reply.Output == nil || reply.Data == nil {
+			return nil, fmt.Errorf("%s's reply has no exit_code, output or data", client.Host)
+		}
+		if *reply.ExitCode == -1 {
+			return nil, fmt.Errorf("%s didn't sign within %s", client.Host, signTimeout)
+		}
+		if *reply.ExitCode != 0 || !strings.Contains(*reply.Output, "[GNUPG:] SIG_CREATED ") {
+			return nil, fmt.Errorf("signing on %s failed with exit status %d: %s", client.Host, *reply.ExitCode, strings.TrimSpace(*reply.Output))
+		}
+		return *reply.Data, nil
+	}
+}