External/buzz

Fork 0

mirror of https://github.com/block/buzz.git synced 2026-08-18 06:50:31 +02:00

Files

T

d99ad131f1 refactor: rename sprout backend to buzz (#958 )

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <wpfleger@block.xyz>
Signed-off-by: Will Pfleger <wpfleger@squareup.com>
Signed-off-by: Will Pfleger <wpfleger96@gmail.com>
Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@sprout-oss.stage.blox.sqprod.co>
Co-authored-by: npub1fgdl5qqnh3k3f2xkqrvt7cujalhm623x4s7fdjdj5yrtp5fzjl9qrjpucw <4a1bfa0013bc6d14a8d600d8bf6392efefbd2a26ac3c96c9b2a106b0d12297ca@sprout-oss.stage.blox.sqprod.co>
Co-authored-by: npub16v54tttfqacx9ycvc3k0ut0npj564ahcuajzy6qjvh57ntmsf4uq4806j2 <d32955ad69077062930cc46cfe2df30ca9aaf6f8e76422681265e9e9af704d78@sprout-oss.stage.blox.sqprod.co>
Co-authored-by: Will Pfleger <wpfleger96@gmail.com>

2026-06-10 19:29:51 -04:00

2.4 KiB

Raw Permalink Blame History

git-credential-nostr

NIP-98 credential helper for git — signs HTTP auth events with your Nostr key so git can push/pull from Buzz's git server without passwords.

Requirements

git 2.46+ (requires authtype capability in the credential protocol)
Rust toolchain (for building from source)

Installation

cargo install --path crates/git-credential-nostr

Setup

# 1. Register the helper and enable per-path credentials.
git config --global credential.helper nostr
git config --global credential.useHttpPath true

# 2. Store your nsec in a key file (must be 0600).
mkdir -p ~/.nostr
echo "nsec1..." > ~/.nostr/key && chmod 600 ~/.nostr/key
git config --global nostr.keyfile ~/.nostr/key

That's it. Use git normally — git clone, git push, git fetch.

CI / CD

Set $NOSTR_PRIVATE_KEY instead of a key file. The env var takes precedence over nostr.keyfile and avoids touching the filesystem:

export NOSTR_PRIVATE_KEY=nsec1...
git clone https://relay.example.com/git/owner/repo.git

How It Works

When a Buzz git server returns HTTP 401 with a WWW-Authenticate: Nostr realm="...", method="GET" header, git calls this helper with the request details on stdin. The helper loads your Nostr private key, builds a NIP-98 kind-27235 event signed over the request URL and method, base64-encodes it, and writes it back to stdout. Git then retries the request with Authorization: Nostr <token>, which the server verifies by checking the event signature.

git ──stdin──▶ git-credential-nostr ──stdout──▶ git
                     │
                     ▼
              sign kind:27235 event
              (NIP-98 HTTP Auth)

Troubleshooting

Error	Cause	Fix
`no nostr key configured`	Neither `$NOSTR_PRIVATE_KEY` nor `nostr.keyfile` is set	Follow the Setup steps above
`insecure permissions`	Key file is readable by group/others	`chmod 600 ~/.nostr/key`
`method hint`	Server's `WWW-Authenticate` header is missing `method="..."`	Upgrade the Buzz server
`useHttpPath`	`credential.useHttpPath` is not set	`git config --global credential.useHttpPath true`
Empty output / no auth	git version is older than 2.46	Upgrade git
`clock skew` / auth rejected	System clock is off by more than 60 s	Sync your system clock (`ntpdate`, `timedatectl`)

2.4 KiB Raw Permalink Blame History