From 79e46aef1ed39d73604548c4af3973dfb5795555 Mon Sep 17 00:00:00 2001
From: randogoth <kflux@posteo.de>
Date: Wed, 14 Oct 2026 12:20:49 +0300
Subject: [PATCH] Genericise the webhook script's usage comment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The header named the serving host's secret store and age key path. A usage
comment is the second thing someone opening this repo reads, and the script
does not need to know where the secret is kept — it reads it from the
environment either way. The concrete invocation lives with the server config.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 bin/register-webhooks.sh | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/bin/register-webhooks.sh b/bin/register-webhooks.sh
index 2d7e84d..71f3e47 100755
--- a/bin/register-webhooks.sh
+++ b/bin/register-webhooks.sh
@@ -12,17 +12,16 @@
 #
 # The secret must be the same value the serving host reads from
 # webhookSecretFile; a mismatch makes every delivery fail the HMAC check and
-# the repo silently stops updating. Pipe it straight out of sops so it reaches
-# neither the terminal nor the shell history:
+# the repo silently stops updating.
 #
-#   <redacted>
+# Both are taken from the environment rather than arguments, so pipe them in
+# from wherever they are kept — an argv is visible to every other process on
+# the box, and a pasted secret stays in the shell history.
+#
+# Usage:
 #   FORGEJO_TOKEN=<token with repo:write on each app repo> \
-#   FDROID_WEBHOOK_SECRET=$(<redacted>=<redacted> \
-#     nix run nixpkgs#sops -- -d --extract '["fdroid_webhook_secret"]' \
-#     <redacted>) \
-#     ../fdroid-repo/bin/register-webhooks.sh
-#
-# Usage: register-webhooks.sh [base-url]
+#   FDROID_WEBHOOK_SECRET=<the shared webhook secret> \
+#     register-webhooks.sh [base-url]
 set -euo pipefail
 
 cd "$(dirname "$0")/.."