Make GPG_PASSPHRASE optional - support subkeys without passphrase

Author: zph

.github/workflows/main.yml

@@ -256,6 +256,10 @@ jobs:
           GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
         run: |
+          # GPG_PASSPHRASE is optional - subkey may not have a passphrase
+          if [ -z "$GPG_PASSPHRASE" ]; then
+            echo "ℹ GPG_PASSPHRASE not set - assuming subkey has no passphrase"
+          fi
           # Install gnupg2 if not already available
           sudo apt-get update && sudo apt-get install -y gnupg2 || true
 
@@ -292,8 +296,13 @@ jobs:
           KEY_FILE=$(mktemp)
           echo "$GPG_PRIVATE_KEY" > "$KEY_FILE"
           
-          # Import the key with passphrase from stdin (never written to disk)
-          echo "$GPG_PASSPHRASE" | gpg --batch --yes --pinentry-mode loopback --passphrase-fd 0 --import "$KEY_FILE"
+          # Import the key - handle both with and without passphrase
+          if [ -n "$GPG_PASSPHRASE" ]; then
+            echo "$GPG_PASSPHRASE" | gpg --batch --yes --pinentry-mode loopback --passphrase-fd 0 --import "$KEY_FILE"
+          else
+            # No passphrase - import directly
+            gpg --batch --yes --import "$KEY_FILE"
+          fi
           
           # Clean up temp file (only contains key data, not passphrase)
           rm -f "$KEY_FILE"
@@ -307,30 +316,32 @@ jobs:
           # Verify key is available
           gpg --list-secret-keys --keyid-format LONG
 
-          # Preset passphrase in gpg-agent for non-interactive signing
-          # This allows GoReleaser to sign without prompting for passphrase
-          # Extract keygrip - try both sec (master key) and ssb (subkey) lines
-          KEYGRIP=$(gpg --list-secret-keys --with-keygrip --keyid-format LONG "$FINGERPRINT_UPPER" 2>/dev/null | grep -E "^sec|^ssb" | head -1 | awk '{print $NF}')
-          if [ -z "$KEYGRIP" ]; then
-            # Try alternative method - get keygrip from the subkey line
-            KEYGRIP=$(gpg --list-secret-keys --with-keygrip --keyid-format LONG "$FINGERPRINT_UPPER" 2>/dev/null | grep -A5 "^sec" | grep "Keygrip" | head -1 | awk '{print $3}')
-          fi
-          
-          if [ -n "$KEYGRIP" ] && [ ${#KEYGRIP} -eq 40 ]; then
-            echo "$GPG_PASSPHRASE" | gpg-preset-passphrase --preset "$KEYGRIP" 2>&1
-            if [ $? -eq 0 ]; then
-              echo "✓ Passphrase preset in gpg-agent for keygrip: $KEYGRIP"
+          # Preset passphrase in gpg-agent only if passphrase is provided
+          # If subkey has no passphrase, skip this step
+          if [ -n "$GPG_PASSPHRASE" ]; then
+            # Extract keygrip - try both sec (master key) and ssb (subkey) lines
+            KEYGRIP=$(gpg --list-secret-keys --with-keygrip --keyid-format LONG "$FINGERPRINT_UPPER" 2>/dev/null | grep -E "^sec|^ssb" | head -1 | awk '{print $NF}')
+            if [ -z "$KEYGRIP" ]; then
+              # Try alternative method - get keygrip from the subkey line
+              KEYGRIP=$(gpg --list-secret-keys --with-keygrip --keyid-format LONG "$FINGERPRINT_UPPER" 2>/dev/null | grep -A5 "^sec" | grep "Keygrip" | head -1 | awk '{print $3}')
+            fi
+            
+            if [ -n "$KEYGRIP" ] && [ ${#KEYGRIP} -eq 40 ]; then
+              echo "$GPG_PASSPHRASE" | gpg-preset-passphrase --preset "$KEYGRIP" 2>&1
+              if [ $? -eq 0 ]; then
+                echo "✓ Passphrase preset in gpg-agent for keygrip: $KEYGRIP"
+              else
+                echo "⚠ Warning: Failed to preset passphrase for keygrip: $KEYGRIP"
+              fi
             else
-              echo "⚠ Warning: Failed to preset passphrase for keygrip: $KEYGRIP"
+              echo "⚠ Warning: Could not find valid keygrip for fingerprint $FINGERPRINT_UPPER"
             fi
           else
-            echo "⚠ Warning: Could not find valid keygrip for fingerprint $FINGERPRINT_UPPER"
-            echo "Debug: Listing keys with keygrips:"
-            gpg --list-secret-keys --with-keygrip --keyid-format LONG "$FINGERPRINT_UPPER" 2>&1 || true
+            echo "ℹ No passphrase provided - subkey should work without passphrase"
           fi
           
           # Verify gpg-agent is running and can sign
-          echo "test" | gpg --batch --pinentry-mode loopback --sign --local-user "$FINGERPRINT_UPPER" -o /dev/null 2>&1 && echo "✓ Test signing successful" || echo "⚠ Test signing failed"
+          echo "test" | gpg --batch --no-tty --pinentry-mode loopback --sign --local-user "$FINGERPRINT_UPPER" -o /dev/null 2>&1 && echo "✓ Test signing successful" || echo "⚠ Test signing failed"
 
           # Test signing capability (GoReleaser will test this anyway, but verify key is importable)
           # Note: We skip actual signing test here since --passphrase-fd consumes stdin
@@ -344,10 +355,14 @@ jobs:
         run: |
           echo "Verifying GPG environment variables..."
           echo "GPG_FINGERPRINT length: ${#GPG_FINGERPRINT}"
-          echo "GPG_PASSPHRASE length: ${#GPG_PASSPHRASE}"
+          echo "GPG_PASSPHRASE length: ${#GPG_PASSPHRASE:-0}"
           gpg --list-secret-keys --keyid-format LONG
-          # Test signing with passphrase
-          echo "test" | gpg --batch --yes --no-tty --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --local-user "$GPG_FINGERPRINT" --sign -o /tmp/test.sig - 2>&1 && echo "✓ Test signing successful" || echo "⚠ Test signing failed"
+          # Test signing - handle both with and without passphrase
+          if [ -n "$GPG_PASSPHRASE" ]; then
+            echo "test" | gpg --batch --yes --no-tty --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --local-user "$GPG_FINGERPRINT" --sign -o /tmp/test.sig - 2>&1 && echo "✓ Test signing successful (with passphrase)" || echo "⚠ Test signing failed"
+          else
+            echo "test" | gpg --batch --yes --no-tty --pinentry-mode loopback --local-user "$GPG_FINGERPRINT" --sign -o /tmp/test.sig - 2>&1 && echo "✓ Test signing successful (no passphrase)" || echo "⚠ Test signing failed"
+          fi
           rm -f /tmp/test.sig
 
       - name: Run GoReleaser
@@ -362,6 +377,7 @@ jobs:
           GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           GPG_TTY: $(tty)
+          # GPG_PASSPHRASE is optional - if empty, GoReleaser won't use --passphrase flag
 
   # terraform-provider-release:
   #   needs: [release]