pass-git-gpg

#!/usr/bin/env bash
set -eo pipefail

#
# Git invokes the following command with commit-data for code-signing.
#
#   gpg --status-fd 2 -bsau {signing_key}
#

while getopts :u:-: OPT; do
    # Skip long options.
    [[ ${OPT} = - ]] \
        && ! [[ ${OPTARG} =~ = ]] \
        && ! [[ ${!OPTIND} =~ ^- ]] \
        && shift
    [[ ${OPT} = u ]] && SIGNING_KEY=${OPTARG}
done

if [[ -z "${SIGNING_KEY}" ]]; then
    # Probably to verify a signed commit.
    exec gpg "$@"
    exit 127
fi

exec 3<<<"$(pass show "gpg/${SIGNING_KEY%!}")"
exec gpg --batch --pinentry-mode loopback --passphrase-fd 3 "$@"