randogoth/fdroid-repo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Genericise the webhook script's usage comment

Browse source 
The header named the serving host's secret store and age key path. A usage
comment is the second thing someone opening this repo reads, and the script
does not need to know where the secret is kept — it reads it from the
environment either way. The concrete invocation lives with the server config.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
randogoth 2026-10-14 12:20:49 +03:00
parent 4f1a67bed3
commit 79e46aef1e
1 changed files with 8 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

17
bin/register-webhooks.sh
View file

@ -12,17 +12,16 @@
#
# The secret must be the same value the serving host reads from
# webhookSecretFile; a mismatch makes every delivery fail the HMAC check and
# the repo silently stops updating. Pipe it straight out of sops so it reaches
# neither the terminal nor the shell history:
# the repo silently stops updating.
#
# <redacted>
# Both are taken from the environment rather than arguments, so pipe them in
# from wherever they are kept — an argv is visible to every other process on
# the box, and a pasted secret stays in the shell history.
#
# Usage:
# FORGEJO_TOKEN=<token with repo:write on each app repo> \
# FDROID_WEBHOOK_SECRET=$(<redacted>=<redacted> \
# nix run nixpkgs#sops -- -d --extract '["fdroid_webhook_secret"]' \
# <redacted>) \
# ../fdroid-repo/bin/register-webhooks.sh
#
# Usage: register-webhooks.sh [base-url]
# FDROID_WEBHOOK_SECRET=<the shared webhook secret> \
# register-webhooks.sh [base-url]
set -euo pipefail
cd "$(dirname "$0")/.."