The hub/28234 wrapper approach (gpg.program=/tmp/gpg/gpg-wrapper.sh with
--passphrase-file) shipped to a customer and still failed with the same
`gpg failed to sign the data`. Root cause is the architecture: pushing
`git commit` into the CLI's spawned process introduces a multi-hop env
propagation chain (Deno → Node spawnSync → git → wrapper → gpg) plus a
dependency on gpg-agent's `allow-loopback-pinentry` being enabled. None
of those failure modes exist in hub/28217's "commit in the same script
process as GPG setup" pattern, which shipped for months without issue.
This commit:
- Reverts LATEST_GIT_SYNC_SCRIPT_PATH back to hub/28230 (= 28217's
in-script commit logic, current known-good).
- Stages hub-scripts/sync-script-to-git-repo-windmill.ts: byte-identical
to hub/28230 except for `windmill-cli@1.703.3` → `@1.705.0`. Once
published this is the next default; the CLI's `sync git-deploy`
subcommand stays available for tests and other callers but the
deployment callback stops using it.
Follow-up: publish hub-scripts/sync-script-to-git-repo-windmill.ts to
hub.windmill.dev, then bump LATEST_GIT_SYNC_SCRIPT_PATH to its new id.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hub/28234 is the forward fix for WIN-1974: replaces hub/28231's agent-cache
pre-warm (which became stale by the time the CLI's `git commit` ran) with
a stateless `gpg.program` wrapper that uses `--pinentry-mode loopback`
(and `--passphrase-file` when a passphrase exists) on every gpg invocation.
Bundled CLI is windmill-cli@1.705.0.
Verified via reproducer at /tmp/git-sync-diff/test-gpg-fix.sh: deliberately
killing gpg-agent between GPG setup and `git commit` reproduces the
customer's `gpg failed to sign the data` error verbatim under the old
flow, and the wrapper signs through it. Holds for passphrase-protected
keys, split-subkey [C]+[S] layouts, and unprotected keys.
Drops the local source-of-truth copy (`hub-scripts/`) — hub is canonical
now that 28234 is published.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This is the script that will be published to hub.windmill.dev once verified
on a customer GPG-signed deploy. It replaces hub/28231's agent-cache
pre-warm (`gpg -bsau` with --passphrase) with a stateless gpg.program
wrapper + chmod-600 passphrase file. Every git-invoked gpg call goes
through the wrapper, which always uses --pinentry-mode loopback (and
--passphrase-file when a passphrase exists). Signing no longer depends on
gpg-agent having a cached passphrase by the time the CLI's `git commit`
runs — which closes WIN-1974.
Not wired in yet: LATEST_GIT_SYNC_SCRIPT_PATH stays on hub/28230 until this
script is uploaded and the new hub id is known. This file is checked in so
the diff is reviewable, future bumps have a source of truth, and a CLI
regression test can `cat` it for fixture parity.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ruben Fiszel