Secure gpg entrypoint

- enable gpg protection
- remove set -x to prevent logging password
- add checks to prevent re-initing pass and gpg
- present passphrase unlock via docker env variable
  - Note: gpg-agent will not expire gpg-present-passphrases
- fix deb CMD to ENTRYPOINT
This commit is contained in:
Echo Nar 2025-12-21 14:31:18 -06:00
parent 044ea2b034
commit c2e8b88188
No known key found for this signature in database
GPG key ID: 06D33D3795EB43AA
7 changed files with 75 additions and 39 deletions

View file

@ -25,4 +25,4 @@ RUN apt-get update \
&& apt-get install -y --no-install-recommends /tmp/protonmail.deb socat pass libsecret-1-0 ca-certificates procps \
&& rm -rf /var/lib/apt/lists/*
CMD ["bash", "/protonmail/entrypoint.sh"]
ENTRYPOINT ["bash", "/protonmail/entrypoint.sh"]