git-nostr-sign

Sign Git commits with your Nostr key. Distributed via Nostr + Blossom. No npm registry.

Last Notes

2026-04-07 19:47:46 GMT

git-nostr-sign v0.4.1
Version 0.4.1 shows the published semver on your Codeberg Pages landing page, adds quick next-step commands for setup updates and doctor, and injects the version from package.json whenever you deploy identity or run ship. Re-run deploy-identity or pull the latest install.sh after updating. git-nostr-update will pick up the new kind 1063 when it appears on relays.

2026-04-07 19:29:53 GMT

git-nostr-sign v0.4.0
Version 0.4.0 fixes Git author hints when Amber signs commits with a different key than your publisher identity, adds git-nostr-sign config-git to reapply Git settings from saved files, and ships status, check-pages, updated default relays, and more tests (including signature armor roundtrip). Upgrade with git-nostr-update or reinstall from install.sh.

2026-04-02 23:33:03 GMT

git-nostr-sign v0.3.0
Version 0.3.0 adds non-interactive setup for git-nostr-setup (-N and GNS_* env), a safer curl installer (strict flags and clear errors for bad npub), larger NIP-46 Connect QR by default, and lots of automated tests including Docker stress and ship dry-run. The setup wizard is clearer for commits-only users. Upgrade with git-nostr-update or reinstall from your usual install path.

2026-04-02 18:38:02 GMT

git-nostr-sign v0.2.3
- **Installer:** Install `nostr-tools` + `ws` in a temp dir **before** NIP-05 resolution so `curl … | sh` on a clean system (e.g. Alpine Docker) does not hit `ERR_MODULE_NOT_FOUND` for `nostr-tools/nip19`. NIP-05 step imports nip19 via `file://…/lib/esm/nip19.js` from that install.
- **Maintainers:** **`pnpm run ship`** runs **`publish`** (kind 1063 + Blossom), **`deploy-identity`** (Codeberg Pages: `install.sh`, `nostr.json`, …), and **`announce-release`** (optional; skip with `--no-announce` or `SKIP_ANNOUNCE=1`). Cursor: command **`ship-release-for-users`**. Dry run: **`pnpm run ship -- --dry-run`**.

2026-04-02 17:52:20 GMT

git-nostr-sign v0.2.2 — installer: POSIX sh (Alpine/BusyBox) mirror URLs; nostr-tools v2 ESM path for the Nostr fetch step. Hosted install.sh on Pages updated. Upgrade: git-nostr-update

2026-04-02 02:13:40 GMT

First public release — git-nostr-sign v0.2.1
If you live in both worlds (Git + Nostr), you have probably wished your commit signatures were just another signed event — same keys, same mental model, no GPG keyserver theatre. This tool is that experiment shipped.
What it does
— Each commit (and tag) gets a signature Git understands: OpenPGP-shaped armor around a JSON payload that is, under the hood, a Nostr event (kind 1639). `git verify-commit` and `git log --show-signature` work the way your muscle memory expects.
— Verification is `nostr-tools` + the commit bytes — no keyring sync, no platform TOS as your trust root for the crypto.
How it ships (why Nostr people should care)
— There is no npm registry artifact to trust blindly. Releases are announced as kind 1063 “package” events, signed by the publisher key you already follow or verify out-of-band. The tarball bytes live on Blossom (and mirrors); the event carries the sha256 you check before install.
— Bootstrap is intentionally boring: `curl` a small `install.sh` from HTTPS (same domain as NIP-05 when you set it up that way), then the script pulls the latest matching release from relays. Upgrades are `git-nostr-update` — same pipeline, no `git pull` of our repo required for end users.
— Publisher npub for this line of releases: npub1af8zexvarrpzn35gurxrrtjv842kl9p9xldqmprn6pgqj7vr6s6qpqkzc2
How you sign
— Local nsec on the machine, or Amber over NIP-46 (including Nostr Connect QR in the setup wizard) so the signing key never leaves the phone if you prefer that threat model.
This is our first broad invitation to try it on real repos and CI boxes. Expect rough edges; issues and patches welcome wherever you track the source.
Install (one line):
curl -fsSL https://nostr-svrn.codeberg.page/install.sh | sh -s -- --npub [email protected]