#!/bin/bash set -e P12_FILE_PATH="$1" if ! [ -f "$P12_FILE_PATH" ]; then echo "No valid file path given." exit 1 fi # Extract user certificate echo "Extracting user certificate from p12..." if ! openssl pkcs12 -in "$P12_FILE_PATH" -clcerts -nokeys -out user_cert.pem; then echo "Extract failed, trying legacy crypto..." openssl pkcs12 -in "$P12_FILE_PATH" -legacy -clcerts -nokeys -out user_cert.pem fi # Extract private key echo "Extracting private key from p12..." if ! openssl pkcs12 -in "$P12_FILE_PATH" -nocerts -out user_key.pem; then echo "Extract failed, trying legacy crypto..." openssl pkcs12 -in "$P12_FILE_PATH" -legacy -nocerts -out user_key.pem fi # Merge them back into a p12 file. Leave out the -legacy if you are still using OpenSSL 1.1. echo "Exporting legacy crypto p12 for import into GPGSM..." openssl pkcs12 -legacy -export -in user_cert.pem -inkey user_key.pem -out user_cert.p12 # Import into gpgsm echo "Importing p12 into GPGSM..." gpgsm --import user_cert.p12 # Set up git to sign commit with your x.509 certificate in every repo you use (global) echo "Setting up global git config..." git config --global commit.gpgsign true git config --global gpg.program gpgsm git config --global gpg.format x509 git config --global user.signingkey "$( gpgsm --list-secret-keys | grep -E '(key usage|ID)' | grep -B 1 digitalSignature | awk '/ID/ {print $2}' | head -n 1)" # Clean up echo "Cleanup..." rm user_cert.pem user_key.pem user_cert.p12 echo "Success 🥳"