Add gpgv-wrapper and aurcade-gpgv integration in Docker

- Added gpgv-wrapper.sh for GPG verification
- Updated Dockerfile to use aurcade-gpgv instead of gpg
- Modified Rust code to integrate new wrapper in GPG commands

3 files changed, 23 insertions, 7 deletions

diff --git a/docker/Dockerfile b/docker/Dockerfile
index 7e9e4c6..47bac51 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -30,7 +30,7 @@ RUN cargo build --locked --release
 FROM alpine:3.21
 ARG CGIT_VERSION
 ENV CGIT_CONFIG=/var/lib/aurcade/cgitrc
-RUN apk add --no-cache git gpg gpg-agent highlight lighttpd mailcap openssh-server py3-markdown py3-pygments \
+RUN apk add --no-cache git gpg gpg-agent gpgv highlight lighttpd mailcap openssh-server py3-markdown py3-pygments \
     && adduser -D -h /home/git git \
     && install -d -o git -g git /home/git/.ssh /var/lib/aurcade /etc/aurcade
 COPY --from=cgit-build /src/cgit-${CGIT_VERSION}/cgit /usr/share/webapps/cgit/cgit.cgi
@@ -44,11 +44,12 @@ COPY docker/cgit-theme.css /usr/share/webapps/cgit/cgit-theme.css
 COPY docker/aurcade-logo.svg /usr/share/webapps/cgit/aurcade-logo.svg
 COPY docker/aurcade-favicon.svg /usr/share/webapps/cgit/aurcade-favicon.svg
 COPY docker/about-filter.py /usr/local/bin/aurcade-about-filter
+COPY docker/gpgv-wrapper.sh /usr/local/bin/aurcade-gpgv
 COPY docker/entrypoint.sh /usr/local/bin/entrypoint
 RUN passwd -d git \
     && sed -i 's/ -X / -O xhtml /' /usr/lib/cgit/filters/syntax-highlighting.sh \
     && highlight -O xhtml --style-outfile=stdout --print-style >> /usr/share/webapps/cgit/cgit.css \
-    && chmod +x /usr/lib/cgit/filters/syntax-highlighting.sh /usr/local/bin/aurcade-about-filter /usr/local/bin/entrypoint \
+    && chmod +x /usr/lib/cgit/filters/syntax-highlighting.sh /usr/local/bin/aurcade-about-filter /usr/local/bin/aurcade-gpgv /usr/local/bin/entrypoint \
     && printf '\nPasswordAuthentication no\nKbdInteractiveAuthentication no\nPermitRootLogin no\nAllowUsers git\n' >> /etc/ssh/sshd_config
 EXPOSE 22 80
 VOLUME ["/var/lib/aurcade"]
diff --git a/docker/gpgv-wrapper.sh b/docker/gpgv-wrapper.sh
new file mode 100644
index 0000000..1715995
--- /dev/null
+++ b/docker/gpgv-wrapper.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -eu
+
+[ "$#" -eq 5 ]
+[ "$1" = "--keyid-format=long" ]
+[ "$2" = "--status-fd=1" ]
+[ "$3" = "--verify" ]
+exec /usr/bin/gpgv "$2" "$4" "$5"
diff --git a/src/main.rs b/src/main.rs
index f7c46a7..3d13a99 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -271,10 +271,12 @@ fn import_gpg_public_key(gnupg: &Path, account: &str, key: &str) -> Result<bool,
         .take()
         .ok_or("failed to open gpg stdin")?
         .write_all(key.as_bytes());
-    if write_result.is_err() || !child.wait()?.success() {
+    let status = child.wait()?;
+    let imported = write_result.is_ok() && status.success();
+    if !imported {
         eprintln!("aurcade: {account}: ignoring GPG public key rejected by gpg");
     }
-    Ok(true)
+    Ok(imported)
 }
 
 fn write_signing_trust(config: &Config, root: &Path) -> Result<(), Error> {
@@ -328,6 +330,11 @@ fn write_signing_trust(config: &Config, root: &Path) -> Result<(), Error> {
     let allowed_signers_path = root.join("allowed_signers");
     atomic_write(&allowed_signers_path, &allowed_signers)?;
     fs::set_permissions(allowed_signers_path, fs::Permissions::from_mode(0o644))?;
+    if used_gpg {
+        let keyring = root.join("trustedkeys.kbx");
+        fs::copy(gnupg.join("pubring.kbx"), &keyring)?;
+        fs::set_permissions(keyring, fs::Permissions::from_mode(0o644))?;
+    }
 
     if used_gpg
         && !Command::new("gpgconf")
@@ -801,8 +808,8 @@ fn push_victory(
             signing_root().join("allowed_signers").display()
         ))
         .arg("-c")
-        .arg("gpg.openpgp.program=/usr/bin/gpg")
-        .env("GNUPGHOME", signing_root().join("gnupg"))
+        .arg("gpg.openpgp.program=/usr/local/bin/aurcade-gpgv")
+        .env("GNUPGHOME", signing_root())
         .arg("--git-dir")
         .arg(repository)
         .args(["log", "--format=%H%x09%G?%x09%GS"])
@@ -821,7 +828,7 @@ fn push_victory(
         let mut fields = line.split('\t');
         if matches!(
             (fields.next(), fields.next(), fields.next(), fields.next()),
-            (Some(_), Some("G"), Some(signer), None) if !signer.is_empty()
+            (Some(_), Some("G" | "U"), Some(signer), None) if !signer.is_empty()
         ) {
             verified += 1;
         }