From 0beab87f5b73893f2a394def51e12de099aa757e Mon Sep 17 00:00:00 2001
From: Somtochi Onyekwere <somtochionyekwere@gmail.com>
Date: Thu, 23 Sep 2021 09:29:21 +0100
Subject: [PATCH] Add gpg key path and passphrase as args

Signed-off-by: Somtochi Onyekwere <somtochionyekwere@gmail.com>
---
 cmd/flux/bootstrap.go                         |   8 +++
 cmd/flux/bootstrap_git.go                     |   1 +
 go.mod                                        |   1 +
 internal/bootstrap/bootstrap_plain_git.go     |  11 ++-
 internal/bootstrap/git/commit_options.go      |  37 ++++++++++
 internal/bootstrap/git/git.go                 |   2 +-
 internal/bootstrap/git/gogit/gogit.go         |  68 +++++++++++++++++-
 internal/bootstrap/git/gogit/gogit_test.go    |  66 +++++++++++++++++
 .../bootstrap/git/gogit/testdata/private.key  | Bin 0 -> 7533 bytes
 internal/bootstrap/options.go                 |  24 +++++++
 10 files changed, 212 insertions(+), 6 deletions(-)
 create mode 100644 internal/bootstrap/git/commit_options.go
 create mode 100644 internal/bootstrap/git/gogit/gogit_test.go
 create mode 100644 internal/bootstrap/git/gogit/testdata/private.key

diff --git a/cmd/flux/bootstrap.go b/cmd/flux/bootstrap.go
index b2359958..2abfc9ff 100644
--- a/cmd/flux/bootstrap.go
+++ b/cmd/flux/bootstrap.go
@@ -68,6 +68,10 @@ type bootstrapFlags struct {
 	authorName  string
 	authorEmail string
 
+	gpgKeyPath    string
+	gpgPassphrase string
+	gpgKeyID      string
+
 	commitMessageAppendix string
 }
 
@@ -119,6 +123,10 @@ func init() {
 	bootstrapCmd.PersistentFlags().StringVar(&bootstrapArgs.authorName, "author-name", "Flux", "author name for Git commits")
 	bootstrapCmd.PersistentFlags().StringVar(&bootstrapArgs.authorEmail, "author-email", "", "author email for Git commits")
 
+	bootstrapCmd.PersistentFlags().StringVar(&bootstrapArgs.gpgKeyPath, "gpg-key", "", "path to secret gpg key for signing commits")
+	bootstrapCmd.PersistentFlags().StringVar(&bootstrapArgs.gpgPassphrase, "gpg-passphrase", "", "passphrase for decrypting secret gpg key")
+	bootstrapCmd.PersistentFlags().StringVar(&bootstrapArgs.gpgKeyID, "gpg-key-id", "", "key id for selecting a particular key")
+
 	bootstrapCmd.PersistentFlags().StringVar(&bootstrapArgs.commitMessageAppendix, "commit-message-appendix", "", "string to add to the commit messages, e.g. '[ci skip]'")
 
 	bootstrapCmd.PersistentFlags().Var(&bootstrapArgs.arch, "arch", bootstrapArgs.arch.Description())
diff --git a/cmd/flux/bootstrap_git.go b/cmd/flux/bootstrap_git.go
index f01d925c..894742c4 100644
--- a/cmd/flux/bootstrap_git.go
+++ b/cmd/flux/bootstrap_git.go
@@ -224,6 +224,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 		bootstrap.WithPostGenerateSecretFunc(promptPublicKey),
 		bootstrap.WithLogger(logger),
 		bootstrap.WithCABundle(caBundle),
+		bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
 	}
 
 	// Setup bootstrapper with constructed configs
diff --git a/go.mod b/go.mod
index f03e0b04..2c03bc94 100644
--- a/go.mod
+++ b/go.mod
@@ -4,6 +4,7 @@ go 1.16
 
 require (
 	github.com/Masterminds/semver/v3 v3.1.0
+	github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7
 	github.com/cyphar/filepath-securejoin v0.2.2
 	github.com/fluxcd/go-git-providers v0.1.1
 	github.com/fluxcd/helm-controller/api v0.11.2
diff --git a/internal/bootstrap/bootstrap_plain_git.go b/internal/bootstrap/bootstrap_plain_git.go
index 6475c40f..898f976d 100644
--- a/internal/bootstrap/bootstrap_plain_git.go
+++ b/internal/bootstrap/bootstrap_plain_git.go
@@ -53,6 +53,10 @@ type PlainGitBootstrapper struct {
 	author                git.Author
 	commitMessageAppendix string
 
+	gpgKeyPath    string
+	gpgPassphrase string
+	gpgKeyID      string
+
 	kubeconfig  string
 	kubecontext string
 
@@ -142,6 +146,7 @@ func (b *PlainGitBootstrapper) ReconcileComponents(ctx context.Context, manifest
 	}
 
 	// Git commit generated
+	gpgOpts := git.WithGpgSigningOption(b.gpgKeyPath, b.gpgPassphrase, b.gpgKeyID)
 	commitMsg := fmt.Sprintf("Add Flux %s component manifests", options.Version)
 	if b.commitMessageAppendix != "" {
 		commitMsg = commitMsg + "\n\n" + b.commitMessageAppendix
@@ -149,7 +154,7 @@ func (b *PlainGitBootstrapper) ReconcileComponents(ctx context.Context, manifest
 	commit, err := b.git.Commit(git.Commit{
 		Author:  b.author,
 		Message: commitMsg,
-	})
+	}, gpgOpts)
 	if err != nil && err != git.ErrNoStagedFiles {
 		return fmt.Errorf("failed to commit sync manifests: %w", err)
 	}
@@ -306,6 +311,7 @@ func (b *PlainGitBootstrapper) ReconcileSyncConfig(ctx context.Context, options
 	b.logger.Successf("generated sync manifests")
 
 	// Git commit generated
+	gpgOpts := git.WithGpgSigningOption(b.gpgKeyPath, b.gpgPassphrase, b.gpgKeyID)
 	commitMsg := fmt.Sprintf("Add Flux sync manifests")
 	if b.commitMessageAppendix != "" {
 		commitMsg = commitMsg + "\n\n" + b.commitMessageAppendix
@@ -313,7 +319,8 @@ func (b *PlainGitBootstrapper) ReconcileSyncConfig(ctx context.Context, options
 	commit, err := b.git.Commit(git.Commit{
 		Author:  b.author,
 		Message: commitMsg,
-	})
+	}, gpgOpts)
+
 	if err != nil && err != git.ErrNoStagedFiles {
 		return fmt.Errorf("failed to commit sync manifests: %w", err)
 	}
diff --git a/internal/bootstrap/git/commit_options.go b/internal/bootstrap/git/commit_options.go
new file mode 100644
index 00000000..e1a9712c
--- /dev/null
+++ b/internal/bootstrap/git/commit_options.go
@@ -0,0 +1,37 @@
+package git
+
+// Option is a some configuration that modifies options for a commit.
+type Option interface {
+	// ApplyToCommit applies this configuration to a given commit option.
+	ApplyToCommit(*CommitOptions)
+}
+
+// CommitOptions contains options for making a commit.
+type CommitOptions struct {
+	*GPGSigningInfo
+}
+
+// GPGSigningInfo contains information for signing a commit.
+type GPGSigningInfo struct {
+	PrivateKeyPath string
+	Passphrase     string
+	KeyID          string
+}
+
+type GpgSigningOption struct {
+	*GPGSigningInfo
+}
+
+func (w GpgSigningOption) ApplyToCommit(in *CommitOptions) {
+	in.GPGSigningInfo = w.GPGSigningInfo
+}
+
+func WithGpgSigningOption(path, passphrase, keyID string) Option {
+	return GpgSigningOption{
+		GPGSigningInfo: &GPGSigningInfo{
+			PrivateKeyPath: path,
+			Passphrase:     passphrase,
+			KeyID:          keyID,
+		},
+	}
+}
diff --git a/internal/bootstrap/git/git.go b/internal/bootstrap/git/git.go
index 103ea49b..1a0f6d86 100644
--- a/internal/bootstrap/git/git.go
+++ b/internal/bootstrap/git/git.go
@@ -44,7 +44,7 @@ type Git interface {
 	Init(url, branch string) (bool, error)
 	Clone(ctx context.Context, url, branch string, caBundle []byte) (bool, error)
 	Write(path string, reader io.Reader) error
-	Commit(message Commit) (string, error)
+	Commit(message Commit, options ...Option) (string, error)
 	Push(ctx context.Context, caBundle []byte) error
 	Status() (bool, error)
 	Head() (string, error)
diff --git a/internal/bootstrap/git/gogit/gogit.go b/internal/bootstrap/git/gogit/gogit.go
index 07248791..333661d5 100644
--- a/internal/bootstrap/git/gogit/gogit.go
+++ b/internal/bootstrap/git/gogit/gogit.go
@@ -25,6 +25,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/ProtonMail/go-crypto/openpgp"
 	gogit "github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
@@ -40,6 +41,12 @@ type GoGit struct {
 	repository *gogit.Repository
 }
 
+type CommitOptions struct {
+	GpgKeyPath       string
+	GpgKeyPassphrase string
+	KeyID            string
+}
+
 func New(path string, auth transport.AuthMethod) *GoGit {
 	return &GoGit{
 		path: path,
@@ -127,7 +134,7 @@ func (g *GoGit) Write(path string, reader io.Reader) error {
 	return err
 }
 
-func (g *GoGit) Commit(message git.Commit) (string, error) {
+func (g *GoGit) Commit(message git.Commit, opts ...git.Option) (string, error) {
 	if g.repository == nil {
 		return "", git.ErrNoGitRepository
 	}
@@ -142,6 +149,12 @@ func (g *GoGit) Commit(message git.Commit) (string, error) {
 		return "", err
 	}
 
+	// apply the options
+	options := &git.CommitOptions{}
+	for _, opt := range opts {
+		opt.ApplyToCommit(options)
+	}
+
 	// go-git has [a bug](https://github.com/go-git/go-git/issues/253)
 	// whereby it thinks broken symlinks to absolute paths are
 	// modified. There's no circumstance in which we want to commit a
@@ -173,13 +186,24 @@ func (g *GoGit) Commit(message git.Commit) (string, error) {
 		return head.Hash().String(), git.ErrNoStagedFiles
 	}
 
-	commit, err := wt.Commit(message.Message, &gogit.CommitOptions{
+	commitOpts := &gogit.CommitOptions{
 		Author: &object.Signature{
 			Name:  message.Name,
 			Email: message.Email,
 			When:  time.Now(),
 		},
-	})
+	}
+
+	if options.GPGSigningInfo != nil {
+		entity, err := getOpenPgpEntity(*options.GPGSigningInfo)
+		if err != nil {
+			return "", err
+		}
+
+		commitOpts.SignKey = entity
+	}
+
+	commit, err := wt.Commit(message.Message, commitOpts)
 	if err != nil {
 		return "", err
 	}
@@ -232,3 +256,41 @@ func (g *GoGit) Path() string {
 func isRemoteBranchNotFoundErr(err error, ref string) bool {
 	return strings.Contains(err.Error(), fmt.Sprintf("couldn't find remote ref %q", ref))
 }
+
+func getOpenPgpEntity(info git.GPGSigningInfo) (*openpgp.Entity, error) {
+	r, err := os.Open(info.PrivateKeyPath)
+	if err != nil {
+		return nil, err
+	}
+
+	entityList, err := openpgp.ReadKeyRing(r)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(entityList) == 0 {
+		return nil, fmt.Errorf("no entity formed")
+	}
+
+	var entity *openpgp.Entity
+	if info.KeyID != "" {
+		for _, ent := range entityList {
+			if ent.PrimaryKey.KeyIdString() == info.KeyID {
+				entity = ent
+			}
+		}
+
+		if entity == nil {
+			return nil, fmt.Errorf("no key matching the key id was found")
+		}
+	} else {
+		entity = entityList[0]
+	}
+
+	err = entity.PrivateKey.Decrypt([]byte(info.Passphrase))
+	if err != nil {
+		return nil, err
+	}
+
+	return entity, nil
+}
diff --git a/internal/bootstrap/git/gogit/gogit_test.go b/internal/bootstrap/git/gogit/gogit_test.go
new file mode 100644
index 00000000..1c8bb311
--- /dev/null
+++ b/internal/bootstrap/git/gogit/gogit_test.go
@@ -0,0 +1,66 @@
+// +build unit
+
+package gogit
+
+import (
+	"testing"
+
+	"github.com/fluxcd/flux2/internal/bootstrap/git"
+)
+
+func TestGetOpenPgpEntity(t *testing.T) {
+	tests := []struct {
+		name       string
+		keyPath    string
+		passphrase string
+		id         string
+		expectErr  bool
+	}{
+		{
+			name:       "no default key id given",
+			keyPath:    "testdata/private.key",
+			passphrase: "flux",
+			id:         "",
+			expectErr:  false,
+		},
+		{
+			name:       "key id given",
+			keyPath:    "testdata/private.key",
+			passphrase: "flux",
+			id:         "0619327DBD777415",
+			expectErr:  false,
+		},
+		{
+			name:       "wrong key id",
+			keyPath:    "testdata/private.key",
+			passphrase: "flux",
+			id:         "0619327DBD777416",
+			expectErr:  true,
+		},
+		{
+			name:       "wrong password",
+			keyPath:    "testdata/private.key",
+			passphrase: "fluxe",
+			id:         "0619327DBD777415",
+			expectErr:  true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gpgInfo := git.GPGSigningInfo{
+				PrivateKeyPath: tt.keyPath,
+				Passphrase:     tt.passphrase,
+				KeyID:          tt.id,
+			}
+
+			_, err := getOpenPgpEntity(gpgInfo)
+			if err != nil && !tt.expectErr {
+				t.Errorf("unexpected error: %s", err)
+			}
+			if err == nil && tt.expectErr {
+				t.Errorf("expected error when %s", tt.name)
+			}
+		})
+	}
+}
diff --git a/internal/bootstrap/git/gogit/testdata/private.key b/internal/bootstrap/git/gogit/testdata/private.key
new file mode 100644
index 0000000000000000000000000000000000000000..9e56432c627b84d068b2fe3f9abd07a8fcb5368a
GIT binary patch
literal 7533
zcmai&Ra6`dvTmVqcXtVH!L^YDXq+?<oIvC55F|LkT>>Gv1b267g1fuBd(b}r+_h%r
zKArPYPxV-}Yk!r3@CVVvSYr(y6>iqbgbmXm=A&rIOUq(GLZh=BlJcW(%MH7kT}*Wv
z5z%}j=afbZdG<z{(#qQdu@$vw<t@=lN4+Qzv*moVtq?(aX)N`0e^1?lC0K{hd%kFN
zg4j0@48AqgTqa13S!A1I$G5Bb%#u?T@{<OTrkHME39G-r4NL^uoiRPs*-g+#BA3xz
z<x<ABcX?Bq3Y|-+j3Q)-IEO#*TN$Wz{IaTHsX^^M4)zn~Y?~gB)(o#q95M1T1D@)^
zi1Zjw@Yi|>bZ$ZRRm`?(W{NK1Ej!VB8T?|>pA~mDl)L7>JiXMnS~!z&TiR$RINFh`
zG>ZWFj<G^jJUQ}&gTl1rDd6zn;o#p;5CEx?IY`6=d8#Lm2&MV=dV|=?t#D?EDR8vE
zir*f6xs%!s=HN#c<JqeuU>_V-Grw_?ci={DM^2YJGBXp}hNUymob860wWBmg6mp2v
z*!=zll~6iS$^o6LFaE-&gR<JsG4~Roi@wr=VE5gU$FJteE#Tn$y0oaiSB|VQ_(R;B
zkJjs~fw7W%{!inC9uW=jM<#II!QA+$ehm>bvyl-Wq-t-1hS=Wz{8q!_IErw;_cK<@
z%4)fKN04&GvR;gl%el>vj#Ta$j3=sU&{Q$+&8~WgB={{9o|gHP>38cSAq(IGGQBYe
zmUi#oFnXFxCMSIDqlYOf)~=#DK!-2!C3$J+o|Fb#`K^<DG$y(|MtMrSz#<<c39)wO
z(n4Z!pF6gTj92|{Tq@j0h7piMj>R8u@afNN#<lF8(!}YkEQ1~J{CTUVNIBY}K;6z|
z*ujsVTJ@|66s6A2h(!cW^Q;=IdpBQv*q_?~I$X^k39AEZ52l+Gri81`1nWl9($ryF
zR#%38^scrJ#-jDlktCb%e{TQ~YiozHd%F~vIcjd<+{aQmX5C2)2Mg!d(e+J4)h3D!
z_j@J|kCPKfPuqZ0N2_DfCDn7FWHwe_z1_fh=SQXo{|Gc<({xefjqM{p(VRGq$+)4H
zaOTE8Im5IwQiFI4{njn~P9K9mdZz>TU>IBWtC|;)U#QMVhM1)LQoi7kR$5e}+*NVE
z9~tR2&pRCo?0K2OvxHed;Z3LeNM3i~3$b7WAp79^=lLd^Zn-F|vYyDd<RxjxPl1Y@
zZi$4xwLAmrUwN)qyJ=g#?~Wb)Tyb}m?*JIVtKut>s6Tv_j);jHI*@Gzg&J*zb}A_S
zO{PHg3vJ>&t@^U7A>qC$Ly5Jh$)WVQyKjOj7U(puiR?&U-He_yJ9?6lS5KyC?&>CI
z=l+#e+~S`q^{--T#%1jYjDS}~B=~2+g^B49&5uYy8!z=ZQ#VnC5uE}^`zHP%B*4E2
z0H8oX!azes0U#5hqoHB|5QzZ@@BnIf07(EGIvVc3n>j*Jo{=U*Zkq{lz$MS4q^Z9z
z!SxD!XPmX@`kC14<fX*3dB1ZKHxIG;&h20Op@c*2bghw8rCAKYhbM_ApDCs92;;I;
z9tN(OZ?fyT{X>RjP{mSk0bSAgU4sC0gV9A7c3Jl--MBySDM<#z8xVmc9!{h;@{J3-
zHp?(6OoLsKngr?Hj7^`m1<WgSJoDPFg=|?vrR7z<m4a-as{$4=x(~v<6n?{(>Aj=H
zLrUK8l6?jpu~hk}Mtu}k_#vC=5D%O5D<DmZPW^!;ku>koudNDQMd4-|+N~PlIfz)T
zf-Be@MRJ4X75Kb(g~eighxjP*Ey*$!Q_&*H(<_DABJ;n{Y;gWmmG0Z2`6#k7Omxa{
zfmL??cs+UWzM1C>ovd)ISzXvS2~j(&9u4G2(l&nxU1-;}fk^A3?i%OqFY`5kD`i)z
z#c7>H`kASvJ2RcoxU{&uJ&`258`aglan<?NEgVWYd-b}!FE2{AnY1){%BRC)xMBnn
zS#Dr-8DP?OMlV+O(wYk8eAr!1gdcvBg#VX5YmHoqo0hJ(HNrL6c%(Aw2bv}nX!|FT
zK57o{0KF#!ACmWlh_UJ9R={-g;t=^zSaNZqL41qmLZ{=d1`DrGY`f9^^v<uFI(Jx%
zw7=Ihp7NF$jMSl5Tzx+lx_6Jlw;D#NDM7X(ofRj^{U2y<B`YfC5yd2&pz9-Smp+R9
zslL_i$QM*2a)kSFmzL7_6XS&co40!LcP!yezJ@EIKo`&8pnIgm`la`ml!(^-p<ynD
z53PZ<Al|L0qgc%!$%^88+np?D^2p$B4z>sex4P*oxmvxL%#ss~W^@~6s*ENefrrD3
zA)E6mA2kodAQUtP8mkIP-tNa&`zzV4ba|nRPMJUIK>>l+giho&*5kk-0>>i!%v*f)
zE7#0*9DC4+7atq<!;2ZWu3CH)Kp#4LFFlL0ZMaXlk)q2OtkkR)ay_Pm7mME<%1mF8
z5C#YSV3Icy7iCbokTjU_s1wZ34(g4pb-I;zi7KvDgXA5K2T$HO?|smRs41wHnqn;_
zY8wuxQ*U)iGzMH5wFuQVwR&*g)~3yA$gm04V{v*RPw!bxRIGW8w&!fP%DtbCR@X!&
zBENlzpqMexc#CZYW#&9?!BG7N<%$m&6Xmt<DKE(jc;siR{Z%e<p|9O_Cl^{CY9sX2
z?db$jUd%)+fkc6dsA~&?(RAivzR*tW=`40Uh@C$3`J-rjnwkLPFgde__L}+on?l>(
zKuy>@(2RZ}e6Nq8C-*9$%ko+EH<x}ooPz2lOB%Vq!uW^JFVxTy{Xs4vy_b=f;Er21
zGqNy<QVG%P_o6(;sgvy+cMxsi%Hh31A>3<UgC+mBB7ox|bhp5@;&4Cq1*TiymPe7-
zr0<SNfbdZxTZ%I~89Z!=mUaka3tO1VUcp@L)FU;jp37fn_mG|0y*4}l#OHyfT*RuU
zo^*b2nY8q<0z>(>fB))cB5Z484Xm^c(V*;cKE2p}q4&P><f?L{NIy&9G;vZB(I?0x
z4PC5DmMzX@)QMV2z4OMk5E6G)F;GYvX*{f*;nhNo#a6sqUoFdFtNE0p-v-Z*T){XO
z0WXM1`VSdt{|_=^{{IB5jX`-qojP}j8AU@LjxHZZMU)8J<)GZ^hiuRk)?t^X?)njI
zWxB3Ju*c1asP`mFOSLWixQY3Mdp{6#qNW)bai5W?BUB>qoJ;Q=U%4GF?q>W8Hu-~7
z&%TDy!s(v5TBj%WmZ?UVOyRu3%74BU)QhxS4(yqO#JK8%HgeO*GSV&(-5gsPp$P}!
zZ+RE`M%+#Vs81_AXv91|%&AtL_nlSB!BkE6xXHL%Vr>~$s$#q+vTS?(?aTA%bJB!?
z<-Jxuv16o@QQYYktyfew7ZnVbk`ES-8BI-WX672g;pG>I7c-1~gWJh4Iq%$_l8pMm
z#QF8`L3DG;I~k^dAM&6S6uE!25e$LHg=;uzcq!(Tdlj1dgc;HQu367=^6JW@*~=_}
z@LJ)kld}q9A7igsLEQj&_wT3~$?UTaxBf3RyF1W;i9q^n#f7BHn@xnSm_y9WeSo=)
z8GDQJ{)kT{J<sdfyS2l`V2AvJmk8;svbzPsIox^$54GRg5AumcMuRiZi?c{lQ};&M
zbbs_p1x1Ul3OMUzeJx-z6JA+)L)fvRZq-@Wj;DCj`|wouAoe~>1>#aS<C~BkN9QEH
z)@f8(xW)W^XHUURtZ@mDUBNFEQFiS*<3<Lb=<Vjt9WsTtV9tJ!Q?rZ}^k%qI1x8~k
z&Um<A5S4mOYyx@0+L{%~%~!p&QVDBBfz1VW=-?9u^y@+NSdhaHiZKqKl@OAyu?*&&
z!%^rB`zOjvvD}*s?Xx|~266^lOH7e}Hm$s2G%j0)7lmNa*LMV3HmiN7V6#*TXF~mI
zM*n01a(zkWSc{B<rLnQjp-_5=!*bGZ%I%q{)5snq3wXWf{ikdhl3wvvK8)hC3L8wI
zdoulzmG`>4EX}s>RxX4Q3C1+4a;>YGggy%v>nO&Z_r=POWJrSfG*wEY9dXxI=Ff2-
zP~o=@zO?3_rpUUegn3H-!u{YYFB15f?mX5U?1(P>C*p&%9};?dtb%?;3EhQ}_{?=q
z-ehK!8Ul@4Uiz9i#Yq!?{K|hW!1v|2xP}2rqZ6kJyEJOp*^xyrGk|_28*-C^)=E~0
ze0$m|2!_3fH}>sF;s3A${bVq`bU2{@lO7|<yV*q%<D7mSn)~C4V7g2a2Wh0itTkC&
z@*o^y>yJH$V#oRJRi6){YPO0lLFrFOd=MKL!yr1CM8x&fP@y<s`b}~2l+(x4r?h_{
zJ$|5leTLuHooY+O?zm*rPcTyVfpj@RVs0nv#%0Z_?tx?$jKP3Zi@v;EGd1g+yqC_$
zp+MlGD|}(awv^bKDfEqg^-@j%oh!g!Y+AD|NH<&~hzz<tmq?MNe7D$F+!5a-!Ktox
z1G8H?>1_f}N-}o}G*L+aI~&?1I{OuzF=PwK35ZZi6)`=kFG<#sg7gSJKH|O>h`jLZ
z^fs7D)J<VBrrTo5pIA|nx)5g^K?{7w?=AD8Dhy}Vi{WX!hSTm|M<IZdqGYyf#h&}J
z5$5-vV-1=NqWBshT`;wGFP7X;8It#~cpJ(GeUqhz21$lYz#GOyyd;yYvn5d+=WeQS
zBg8Mr%o~b_N>MA{Dp3wc*lDmh80kQtPP7-6x`DV_h#EN&-16kIVle<Ql5!mU$Z^7!
zfBlfcPUtld#D*+%V~Vod+Me8IQ>Vq-j4g|wcY}5zl25UbjfMwL1sIhp<JA^*wF3C@
z2A|@kb$5(5cTAhJ(i__D8?*{MjPE77z0X2E)I2nwmPj*TC5=wK824YRDK=kKuJ&uT
z=zpglc8bvr%-q1CiL~j+K`KeJ=y$eekC~4K@$?9?%uht0h5S7H>(Bf{T7YCt-nB3C
z&4esJ`5u-FX%;-@2Upe$VFpSgZ`NmWbGwf9VS7l1?9MGlBBC@(BTxzKewqXYw_N-)
z3RvY-Zw%+h9TkLb)<J>B<LB0Vh6+xp_RqI@lRE_ygIYd2{PQ6ts2ZA-Q)PVbBvLGM
z)wN~d0syc-o2vGS<)=Ed$4o+<0#JhN_SrzK4KgoH<hAr!Q^@OSDT=^uDwT({$g*b*
zbWh)SW2W(Vh>I+j8c)qQzXb-hi12vuI)f*`VZTF)dQ(E&k-&wN88Qj%Q~mD6ru)R!
zB0>7@Nuv|paYLf|?>fI{3#$pnyWyN6py%uK4^fHYAxRu9=_*V6u=OB`2UOnQs`5&C
z?VMA#L7G0xeAdvCO3J9cQ-!cO-y=RNV~wcUZaL5Md(=+F^5ReE&roCRfmKm%;NAdY
zYYe0kYq75l>A)NKEgV&sI?JFmHkX`|ZZ&bm63%c_)?^6eRlbbWN%4w9#nn(jI*Nk&
z-f<Q6P)|Pqh5k(Ntwn&I#UypmTdHIH@KAd6!B16$ir{BPR%|5p)@@*gnBIz{D+o=+
zRn+*o!(;y1oHT#lPkCG7x#8HckPn+uE&jDJ3JqY&t;|gOEqK47<S#uM(93soJ~h|#
z%kyL$I`T=IRn^QPuc_3yzKFI?aVaG+gQL8d-OFwfT=LNA>B4Ck3uMU=_aX1X%7>nA
zJ}19V$(a!WG3jf2XtKK_O)`Cp2E&O;;jqjTPOM(1N6*{If=0cxFoBd($vF>Iw-(&w
zN0#4CM;7M;R5N8n4v&?h*P~);VONOSIy0F`C-2|vnSdj;WLtF^0ZFgUr^fdeTE`<m
zC0nHDbuqRpODqzzoIIAEP6Q>L`*5Vu;VD%#%K38<rW?f<NBbxgbn%KPpKq4k(G8xh
z<O|Wn0dUaBG0yw22V#c%je>>D)3!B7Qal(e69L?aG82S_;y5P0*<@P%nE_du2Q7r~
ze~WE^|HihKN`k|KO&(U<AC23{WW3)xJl%-?72Cj&|0A~jyV+qJ2c|_<#&ysRJOCd)
z>z@pbiADXAEBt<wvGWD(Y>?o)rRzuK#7`Pi^n>@f$7w6J%)8-vZFiNbCZAbIBS@6G
znQ2@7XgIKz`*l8nuqceQk&&;wLdwV6$e(q^bH*8J_SGd@21}H%R`{Hb&ro6M-a4LS
zO-7$S9*wCg&<&C{yi~gTJlU`7EVQP!tQylAEIHWqxROw3Bg3?U@qk`2T$P9@j8q{S
zDw9F5xJYXW>VT|4Bf(5*nS}C$HBL)n8q$Sp@40EB4Zk!bGj!K<J-E&I8SkZMaEV1e
zUOVYpOAD7?6yZ$Qc`g@QW_u$_z{uF8;VPa{F>d{7|I>ydaVFb*!~9^W1_vV0$HDcg
z(N=X~RmzeL%%IPp`q)1jwtU`^J-todeee1OL9vC^Q_WM&A3bmACMubvBX-FN@AN#_
z81FX;<VGe15Fv=gy0?Ghxw%lIMAi%=q6kzEhrZBQGk+Jdjq}q*NYhQZi$-uEpt-?5
z-!cx8jYn%YXlKD|^wakH`$Q$4+&3Yj5(98^cyL-1OVf7xuCWLYg_-wz<$w1=z?6)B
z;PB<*%*KzqnC)Hm9J~H&(R#NzyilM&=<Y?Z(tftP6z(XOdA5M>Mv{*?={ixG=d}T6
zh+(<wj4OWipr+5cwg7NU>nO@t;5E7<0ElO&8_RIj@MfaO{#)AmBo-~>-e7!}v58H3
zp+IC-s=4y9&aH(3s#*vGwt@pnxMs%p*0?(NH4Anb0ZYtERDteT0u->=4Y8jDIJ6O4
zXUhnS#TOqqUUWA=Zjt(_53c0)HGKIYczcRKCmDwpD@yXOjLB<^yb!-zP$6N|zNteZ
z<d5wsF-V0Lh*c7}%!2)WzRo3<kmJMdsiDHdA@UQiCXpXEBo-&p_sEWyowDP`RqM=6
ze*K^uYgB!F>iS0}J;oI(TD%Q2m&pZg+?OtD0>+h@J9#Tk0rtopZu-l<ug|To{^eS5
z)oJx@VUk^@=z>GuNA?xmo9Tx8A9;o1nq&eA+VjySTHw`@_5;H6vq=rWLwGc0?o6G3
zrA@sBKUA3Ms8>>W9R+BzhP7d|(+|u<$95LRcp~ZGtTqm`w|1u>%@xO6p=rEtopYp|
zJ_?1_6CQunqRKeesB-4JK`H`!nMCnJi3=*HinZhm*LhV9%tzq$m%0vmk&A!1yRZQy
zOjByE1od_ypVQd>kjm!OO*<p^Qi}+b2oB0@hXsaQ+s6l|$i0J>k+eDnRXsGwjh=Zw
z_xVazy&Jp~0ML${Vb$6M!P1rkVUItU_0_+FVUc<d1-SQIs%h;}2kJsh{7(%=4pb_z
zOttF-qfR}%Ekf&%%WQ1!LA$J&y4@AJvlNj140!85(zYtaRj0?03pyDy`U}3{qV=%%
z_@muU&pPFaWPn^RNSDG?qdz9$);GG_J&8%D4LA+WJd{$dV5={eKY|zTbo+e)WIw_1
zz%kQkAL$Ey^CpOHR_D$!eIi@0svlQ&M{2-Vjk+SeYQTMU5O$`=EO8T&BJ9-7YKmDk
zXcm|$uZyW|>||~z?2y^Ld!`||0lyjSdA9SUmSp>9e+~mP^eggO%tq&VWrw@5eAVc(
zV#82!ZV1Os3esI{2@p)_qMF6ah)a#ZXsHr)2}DWf=(9n+J7EfQ8LVFWiR&F_f-|2p
zmV+_uSs>wSV}6N*huuOw4j;FW&z)`rRZ5ADK1$sb`&smzfjxN#Kqa7kq(svHKEnjt
z!NKI_Z><(y+z;j0SM85tpzyCj=`}E(w2;LrW@mytMUM@DHI~W7BBR&|qtVYN-is1H
zuIvkhjA%#X3QedH@_Ugb=$&KeyUFK0Bk+qLJG^{FWA7s-8|g%&eMM6_Xm%23Ge)}y
zcf+hym4+Jd81?INI4SbmrMx=lh8|p5V_lz(+bpjnL-8Dti$^iX;E4xf&p}#c<H#+M
zZ-s<KCxDeHx3!S+H@@MpoOp2C&Vy?CH>KrXZMZ@kE5+_!p5l$CfIYel=_m&U<b}yK
zHoReOx*bTaU+PrW-*&Yk{$7%|8ycWKoS|=qQ}?6!<nx*oij*$$s`^A%$lpMQ)CAgz
zYse(2nw`lhH9p!UP6c#6+Z?gYRI%L1YM?Q%cg9FMd{Y<V+cOua7fi9_eG^qM1S&`H
z&&sT@&M=>}9w5iwwo@G@B$hPKbn}+s>Gptg$QO*09}Czu=ICSS$jKdwqa8}>8>|)*
z`Sue*%^rC4&{Gf{!TmaUsxqqBfJz<lOBh2)b&#G8dGE?G`E~lJ)fw~3CO8vT|MDi2
zu-VBV0KYDJALcue5fJd1jD!PE5qNKuI42v~w43SuXNP>;9QJqRjWM>7@^<D+(QLxR
zqGL~)qod#l1bP#UD4~&zKs>JksRK=kW+kwX+V#u*7d_h|rg7OHJ{;6BOEjcZaojFy
zGx2j@RpU}=7q(rA3F!*<OA0GEHaq&zqBRlDd5al=Ul$Ark;4?2zd(_{rlttfB<NS9
zRx8b%5#szFZWv1Bp8aws^nzX-!*<dOW*TB#iac@l?<Rvy;*DjUW8N^4kKX%|sp8ng
zU%KwnK#xwhvuO6bjT<(KJ2UDIvkM38g~wc7#&X>0n4@j=ddyM!Ww-H3Ay}8aG!yU4
zhOvF(G&GfQf@${seK1ud@k;9ne+!)HC!_Po_#eV1K-8@+(jiB-Aw871-?Euna`(^}
zH)i&)izp|^SZlw0-*6po>ubJbLIqI-T%~=4q7d?}MICvt3|g$nL(06Phi0Q=-`xVx
zl{smWe#JOh)P7zmLWO%`mX)!9ZzFcHTL@^=Ou&Ef#@|+n25v{Ql~U3oeGw0g?H|Ux
zD0AC<lm3$*Xhx`1|0}}KM8ALUmC`*?qYnCelG;nsec~k{rUs#sOt>IZtG<116GM8S
z2E0Mybk{&SJ_#1^D0-}#m<WxYZ(~84a_+~$Ri#>S>Dc78i*NFLjPK8>RNeI5?7nw&
zWaTinKw?n2aGE^-*#7en&o~nBCk-~77d9edQ{VzwqR{jfU8*>xnw?UK&+c-adAPu`
z6%Fq_7R6lt*~^ZL_^eFQifc*ReM<QGJ#eoUStZ#_jIxVvNyMEF-b<m;+fkBb=N7_(
zfFjD4%gsXuM@V@m6B-i%`0v-~e-pF+_ci*rfKln<zzi)A`Rl`9D@)dtlw@P%;csp2
z_Kt*Halccl!l`96ZTZ~3w@m0O$UowJ^}u#TD~mv*4mU@@34s16BjbCVOLg`)$>wQ0
z$dN35`_SVbb8y^3kA5sdR??qQ_(vkHZ)HnaXtnZP7T^rF8xa2y=Z)f8P^~Bdz<5VL
zPy3<%2lqD-vZVYLZo7Hg^OK*DRso;eUJqi{niCAgR@yH_Ij(%iAMhx+Sh+K?&TKpp
z!At{?Jz5sD#mFN*?4HVp%?<OtslqvVDk|=uYZ7ezQj;hYBG|X&?86i%c86Rf3<kB)
zipQ;~qsgQfpM~0cZa_jVQk{3L#Hf(D!6>=IH9<A<<={|^hiPjVf{fzmz#Q*Z+z#&O
zeZpsWI=hLqZO7HOiriW(fp4bzQ047kO)qik!$gt#j|aL<fkh=AU`KOmQy#y%<(=JW
zaj|1wQPJ1->(rG{_K$Lr9>sc$`umE!igkpbHtGXtBgI#Qoz$@yQ_nYj0fk<W8GmsN
z{>9%q8n^H>Xi5R7d?U;$ToEcXtFZ7Z0MSZ`R8E>Gi)$?IG9J$TwWuLpQgLpN3)$)!
z3OQjjE9~avbEAEiRQ({G&$c2t6mU(Er@MCiZCJ($Q8tx-BZNW>=dIt$#57((B1k*K
ft-xqkuRheWZP%@%?e?MIkB-Fr8=y(%LF<12??PVJ

literal 0
HcmV?d00001

diff --git a/internal/bootstrap/options.go b/internal/bootstrap/options.go
index 88972c1e..750f66e9 100644
--- a/internal/bootstrap/options.go
+++ b/internal/bootstrap/options.go
@@ -112,3 +112,27 @@ func (o loggerOption) applyGit(b *PlainGitBootstrapper) {
 func (o loggerOption) applyGitProvider(b *GitProviderBootstrapper) {
 	b.logger = o.logger
 }
+
+func WithGitCommitSigning(path, passphrase, keyID string) Option {
+	return gitCommitSigningOption{
+		gpgKeyPath:    path,
+		gpgPassphrase: passphrase,
+		gpgKeyID:      keyID,
+	}
+}
+
+type gitCommitSigningOption struct {
+	gpgKeyPath    string
+	gpgPassphrase string
+	gpgKeyID      string
+}
+
+func (o gitCommitSigningOption) applyGit(b *PlainGitBootstrapper) {
+	b.gpgPassphrase = o.gpgPassphrase
+	b.gpgKeyPath = o.gpgKeyPath
+	b.gpgKeyID = o.gpgKeyID
+}
+
+func (o gitCommitSigningOption) applyGitProvider(b *GitProviderBootstrapper) {
+	o.applyGit(b.PlainGitBootstrapper)
+}