Azure Key Vault GPG Key Management

01-upload-akv-gpg-keys.ps1

# Export and upload GPG keys to Azure Key Vault
$UserId = "" # GPG email address
$SecretKeyName = "github-gpg-secret-key"
$PublicKeyName = "github-gpg-public-key"
$KeyVaultName = "" # Key Vault Name
$SecretKeyFile = ".\sk.asc"
$PublicKeyFile = ".\pk.asc"

# Send Private Key
$(gpg --armor --export-secret-keys --with-fingerprint $UserId) | Out-File $SecretKeyFile
$SecKeyInfo = $(gpg -K --with-fingerprint $UserId)[0]
$SecKeyExp = $SecKeyInfo.SubString($SecKeyInfo.IndexOf("[expires: ") + 10, 10)
az keyvault secret set --vault-name $KeyVaultName --name "$SecretKeyName" --encoding utf-8 --expires "$SecKeyExp" --file $SecretKeyFile --query "id" -o tsv
Remove-Item $SecretKeyFile

# Send Public Key
$(gpg --armor --export --with-fingerprint $UserId) | Out-File $PublicKeyFile
$PubKeyInfo = $(gpg -K --with-fingerprint $UserId)[0]
$PubKeyExp = $PubKeyInfo.SubString($PubKeyInfo.IndexOf("[expires: ") + 10, 10)
az keyvault secret set --vault-name $KeyVaultName --name "$PublicKeyName" --encoding utf-8 --expires "$PubKeyExp" --file $PublicKeyFile --query "id" -o tsv
Remove-Item $PublicKeyFile

02-import-akv-gpg-keys.sh

# Import GPG keys from Azure Key Vault
KV_NAME="" # Key Vault Name
SECRET_KEY_NAME="github-gpg-secret-key"
PUBLIC_KEY_NAME="github-gpg-public-key"

# Import Public Key
az keyvault secret show --vault-name $KV_NAME --name $PUBLIC_KEY_NAME --query "value" -o tsv | gpg --import

# Import Private Key
export GPG_TTY=$(tty)
az keyvault secret show --vault-name $KV_NAME --name $SECRET_KEY_NAME --query "value" -o tsv | gpg --import

# Configure git to use GPG key
USER_ID="" # GPG email address
SIGNING_KEY=$(gpg --list-signatures --with-colons --with-fingerprint $USER_ID | grep 'sig::' | head -n 1 | cut -d':' -f5)
git config --global user.email $USER_ID
git config --global user.signingkey $SIGNING_KEY
git config --global commit.gpgsign true
git config --global tag.forceSignAnnotated true

# Set trust on key
gpg --edit-key $SIGNING_KEY
# command: trust
# level: 5 / ultimate

03-set-git-signing-key.ps1

# Set git to use the GPG signing key
$UserId = "" # GPG email address
$SecKeyLongId = $(gpg --list-secret-keys --with-fingerprint $UserId)[1].Replace(" ", "")
$SecKeyId = $SecKeyLongId.Substring($SecKeyLongId.Length - 16)
git config --global user.email $UserId
git config --global user.signingkey $SecKeyId
git config --global commit.gpgsign true
git config --global tag.forceSignAnnotated true