mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
d99ad131f1
Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <wpfleger@block.xyz> Signed-off-by: Will Pfleger <wpfleger@squareup.com> Signed-off-by: Will Pfleger <wpfleger96@gmail.com> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@sprout-oss.stage.blox.sqprod.co> Co-authored-by: npub1fgdl5qqnh3k3f2xkqrvt7cujalhm623x4s7fdjdj5yrtp5fzjl9qrjpucw <4a1bfa0013bc6d14a8d600d8bf6392efefbd2a26ac3c96c9b2a106b0d12297ca@sprout-oss.stage.blox.sqprod.co> Co-authored-by: npub16v54tttfqacx9ycvc3k0ut0npj564ahcuajzy6qjvh57ntmsf4uq4806j2 <d32955ad69077062930cc46cfe2df30ca9aaf6f8e76422681265e9e9af704d78@sprout-oss.stage.blox.sqprod.co> Co-authored-by: Will Pfleger <wpfleger96@gmail.com>
70 lines
2.4 KiB
Markdown
70 lines
2.4 KiB
Markdown
# git-credential-nostr
|
|
|
|
NIP-98 credential helper for git — signs HTTP auth events with your Nostr key so git can push/pull from Buzz's git server without passwords.
|
|
|
|
## Requirements
|
|
|
|
- **git 2.46+** (requires `authtype` capability in the credential protocol)
|
|
- **Rust toolchain** (for building from source)
|
|
|
|
## Installation
|
|
|
|
```bash
|
|
cargo install --path crates/git-credential-nostr
|
|
```
|
|
|
|
## Setup
|
|
|
|
```bash
|
|
# 1. Register the helper and enable per-path credentials.
|
|
git config --global credential.helper nostr
|
|
git config --global credential.useHttpPath true
|
|
|
|
# 2. Store your nsec in a key file (must be 0600).
|
|
mkdir -p ~/.nostr
|
|
echo "nsec1..." > ~/.nostr/key && chmod 600 ~/.nostr/key
|
|
git config --global nostr.keyfile ~/.nostr/key
|
|
```
|
|
|
|
That's it. Use git normally — `git clone`, `git push`, `git fetch`.
|
|
|
|
## CI / CD
|
|
|
|
Set `$NOSTR_PRIVATE_KEY` instead of a key file. The env var takes precedence
|
|
over `nostr.keyfile` and avoids touching the filesystem:
|
|
|
|
```bash
|
|
export NOSTR_PRIVATE_KEY=nsec1...
|
|
git clone https://relay.example.com/git/owner/repo.git
|
|
```
|
|
|
|
## How It Works
|
|
|
|
When a Buzz git server returns `HTTP 401` with a
|
|
`WWW-Authenticate: Nostr realm="...", method="GET"` header, git calls this
|
|
helper with the request details on stdin. The helper loads your Nostr private
|
|
key, builds a [NIP-98](https://github.com/nostr-protocol/nips/blob/master/98.md)
|
|
kind-27235 event signed over the request URL and method, base64-encodes it, and
|
|
writes it back to stdout. Git then retries the request with
|
|
`Authorization: Nostr <token>`, which the server verifies by checking the event
|
|
signature.
|
|
|
|
```
|
|
git ──stdin──▶ git-credential-nostr ──stdout──▶ git
|
|
│
|
|
▼
|
|
sign kind:27235 event
|
|
(NIP-98 HTTP Auth)
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
| Error | Cause | Fix |
|
|
|-------|-------|-----|
|
|
| `no nostr key configured` | Neither `$NOSTR_PRIVATE_KEY` nor `nostr.keyfile` is set | Follow the Setup steps above |
|
|
| `insecure permissions` | Key file is readable by group/others | `chmod 600 ~/.nostr/key` |
|
|
| `method hint` | Server's `WWW-Authenticate` header is missing `method="..."` | Upgrade the Buzz server |
|
|
| `useHttpPath` | `credential.useHttpPath` is not set | `git config --global credential.useHttpPath true` |
|
|
| Empty output / no auth | git version is older than 2.46 | Upgrade git |
|
|
| `clock skew` / auth rejected | System clock is off by more than 60 s | Sync your system clock (`ntpdate`, `timedatectl`) |
|