Sign .html files with gpg - detached signature

sign_html_gpg.md

HTML Signing

Inspiration

Automate Signing with a MakeFile

Create a MakeFile in the root of your git project.

This MakeFile will recursively look through all dirs for any .html file, starting at the root. It will then sign the file and create a detached signature contained in a .html.asc file.

• Firstly, generates a list of the required signatures in SIGS by subsituting .html for .html.asc in every filename matching the glob /.html.
• The default target of all is defined as comprised of all the SIGS. This means you can type make without specifying a build target
• Declare a rule for producing a .html.asc file from a .html file with the same root name.
• The rule runs gpg --armor --detach-sign on the HTML file, producing a signature.

Again, thanks to source

HTMLS := $(shell find . -type f -name \*.html)
SIGS := $(patsubst %.html,%.html.asc,$(HTMLS))
all : $(SIGS)
%.html.asc : %.html
	gpg --armor --detach-sign $<

Git Hook

Automate signing/validation with a git hook .git/hooks/pre-commit. This script also uses tidy to validate HTML, remove if you prefer not to validate.

#!/usr/bin/env bash

# Need extglob for the +(0) bit
shopt -s extglob

# Start counting errors
declare -i errors

# Read records supplied by git diff-index, null-terminated; we only want the
# sha1 object name of the staged file
while read -r -d '' _ _ _ sha1 _ ; do

    # git diff-files has a NULL both before and after the filename it prints,
    # so we need to run read again to get the filename out to move on to the
    # next record (this is a bit weird, but it does seem to work consistently)
    read -r -d '' filename _

    # Skip the file if its digest is empty or is all zeroes, the latter being
    # how diff-index shows deleted files or moves
    [[ $sha1 ]] || continue
    [[ $sha1 != +(0) ]] || continue

    # Skip the file if it's an ignored path
    [[ $filename != public_html/blinkenlights/* ]] || continue

    # Skip the file if it's not HTML
    [[ $filename == *.html ]] || continue

    # Show that we're checking it
    printf 'Checking modified %s ... \n' "$filename"

    # Check HTML formatting
    git cat-file -p "$sha1" |
    tidy -eq -utf8 ||
    ((errors++))

    # Check ASCII signature up to date
    git cat-file -p "$sha1" |
    gpg --verify -- "$filename".asc "$filename" >/dev/null ||
    ((errors++))

# Standard input for the while loop is here
done < <(git diff-index -z --cached HEAD)

# Exit 0 if there were no errors, 1 if there were
exit "$((errors > 0))"

Make the script executable and you're good to go

chmod +x .git/hooks/pre-commit

Usage

To generate sigs for all .html files in dir/subdirs.

make

Additionaly, git commit will validate signs.