1 files changed, 84 insertions, 0 deletions
diff --git a/git-sign-for-cgit.1 b/git-sign-for-cgit.1
new file mode 100644
index 0000000..e7776e4
--- /dev/null
+++ b/git-sign-for-cgit.1
@@ -0,0 +1,84 @@
+.Dd July 17, 2021
+.Dt GIT-SIGN-FOR-CGIT 1
+.Os
+.Sh NAME
+.Nm git-sign-for-cgit
+.Nd store a signature of an object for release with cgit
+.Sh SYNOPSIS
+.Nm git sign-for-cgit
+.Op Fl f Ar format
+.Ar object
+.Sh DESCRIPTION
+.Nm
+creates a signed checksum list for an archive of the named object.
+The list is stored in
+.Em refs/notes/signatures/<format>
+using
+.Xr git-notes 1 ,
+and is suitable for distribution via cgit.
+.Pp
+To publish the signature, push
+.Em refs/notes/signatures/<format>
+to the remote cgit repository.
+cgit will then automatically pick the right signature for the respective
+archive format.
+See
+.Sx NOTES
+for an in-depth discussion of how this works.
+.Pp
+Signatures are created with
+.Xr signify 1
+using the secret key defined in
+.Ev SIGNIFY_SECKEY .
+If unset, the key at
+.Pa ~/.signify/release.sec
+is used instead.
+.Pp
+For supported archive formats, see
+.Xr git-archive 1 .
+A default archive format can be set via
+.Xr git-config 1 ,
+using the
+.Em package.format
+option.
+Note that the chosen archive format must also be supported by cgit.
+.Pp
+The options are as follows:
+.Bl -tag -width Ds
+.It Fl f Ar format
+The format of the underlying archive.
+Defaults to
+.Em package.format ,
+or tar.gz if unset.
+.El
+.Sh ENVIRONMENT
+.Bl -tag -width Ds
+.It Ev SIGNIFY_SECKEY
+The secret key to use for signing.
+.El
+.Sh FILES
+.Bl -tag -width Ds
+.It Pa ~/.signify/release.sec
+The secret key to use if
+.Ev SIGNIFY_SECKEY
+is unset or empty.
+.El
+.Sh NOTES
+.Bl -enum
+.It
+.Sy Hosting signify signatures on cgit
+.Pp
+https://oriole.systems/posts/signify-cgit
+.El
+.Sh SEE ALSO
+.Xr git 1 ,
+.Xr git-archive 1 ,
+.Xr git-config 1 ,
+.Xr git-notes 1 ,
+.Xr signify 1 ,
+.Xr cgitrc 5
+.Sh AUTHORS
+.An -nosplit
+.Nm
+was written by
+.An Wolfgang Müller Aq Mt wolf@oriole.systems .