Add tag from pipeline with signing required

[Kyle Hancock]

We are trying to add a tag from within our pipeline as noted here: 

https://support.atlassian.com/bitbucket-cloud/docs/push-back-to-your-repository/

However, the challenge is that we require all commits to be signed. As far as I can tell, there is no valid signature in the default pipeline. My approach has been to import GPG keys via repository variables to be used for reconfiguring git. 

Thus far I can't get the GPG keys to import successfully although this script runs elsewhere without issues. Any ideas as to how we can sign a commit / push a signed tag from within a pipeline? Example shell script below

#restore private
echo "$pub_key" > public.gpg
echo "$pri_key" > private.key

gpg --import public.gpg
gpg --import private.key
echo "Keys imported sucessfuly"

rm -rf public.gpg
rm -rf private.key
echo "Key files removed sucessfully"

git config --global user.signingkey $key_serial
git config --global commit.gpgsign true
git config --global tag.gpgSign true

[Kyle Hancock · Accepted solution]

For anyone else that finds this in the future I had to abandon using git natively and move to the Bitbucket API via python scripts. It took far more code than should have been necessary but as far as I was able to determine it's nearly impossible to use signed commits inside a pipeline. 

Suggestion - Bitbucket should configure (or offer a way to configure) what the native CICD user permissions are and allow it to sign commits / tags. 

[Mark C]

Hi @Kyle Hancock

Apologies for the delay here.

We created a public KB article on how to achieve this: https://confluence.atlassian.com/bbkb/how-to-push-gpg-signed-commits-tags-to-a-repository-from-pipelines-1528302892.html

You could give it a try and see if it is useful for you.

Regards,
Mark C

[Mark C]

Hi @Kyle Hancock

Welcome to the community.

Allow me to check this internally and get back to you.

Regards,
Mark C