Toot Wrapper - Mastodon with GPG Verification

Sign and verify Mastodon posts using GPG. Each post is cryptographically signed and committed to git before publishing, with a verification link included automatically.

Quick Start

./post.sh "Your post text here"

This will:

Save post to ../mastodon-posts/posts/YYYY-MM-DD-###.txt
GPG sign the post → ../mastodon-posts/posts/YYYY-MM-DD-###.txt.asc
Commit to git with cryptographic signature
Push to your Gitea instance
Generate a verification link
Post to Mastodon with the link appended

Character limit: 5000 characters (default). Posts longer than this will be rejected.

Configuration

Configure via environment variables (or edit defaults in post.sh):

Variable	Default	Purpose
`POSTS_REPO_DIR`	`../mastodon-posts`	Path to posts repository
`GPG_KEY`	`r3r4um@social.r3r4um.net`	GPG key ID or email for signing
`GITEA_HOST`	`git.r3r4um.online`	Gitea instance hostname
`GITEA_PORT`	`2222`	Gitea SSH port
`GITEA_USER`	`r3r4um`	Gitea username
`POSTS_NAMESPACE`	`r3r4um`	Gitea namespace (org/user)
`POSTS_REPO_NAME`	`mastodon-posts`	Gitea repo name
`MAX_CHARS`	`5000`	Maximum post length in characters

Example: Custom Setup

export GITEA_HOST="gitea.example.com"
export GITEA_USER="alice"
export POSTS_NAMESPACE="alice"
export GPG_KEY="alice@example.com"
export POSTS_REPO_DIR="/path/to/alice-posts"

./post.sh "Hello world"

Verification

Anyone can verify a post's authenticity:

# Clone the posts repository
git clone <REPO_URL>
cd mastodon-posts

# Import the signing key
gpg --import public-key.asc

# Verify a specific post
gpg --verify posts/YYYY-MM-DD-###.txt.asc

# Verify all git commits
git log --show-signature

The post content is in posts/YYYY-MM-DD-###.txt and the GPG signature is in posts/YYYY-MM-DD-###.txt.asc.

Post Format

Your post text is appended with a verification link:

Your message here

🔐 Verify: https://gitea.example.com/namespace/repo/blob/COMMIT_HASH/posts/YYYY-MM-DD-###.txt.asc

Note: The verification link counts toward your character limit. Plan accordingly (keep posts ≤~4900 chars).

Requirements

toot CLI (configured and logged in)
gpg (for signing)
git (for commits/pushes)
SSH access to Gitea instance
Mastodon/Mitra account and credentials in toot config

Setup Steps

Fork this repo (or clone it)
Create a mastodon-posts repository (adjacent to toot-wrapper, or set POSTS_REPO_DIR)
Generate a GPG key (if you don't have one):
```
gpg --full-generate-key
```

Export your public key to mastodon-posts/public-key.asc:

gpg --armor --export YOUR_EMAIL > ../mastodon-posts/public-key.asc
git add public-key.asc && git commit -m "Add GPG public key"

Configure toot to use your Mastodon account:
```
toot login --instance mastodon.social
```

Test the wrapper:

./post.sh "Test post from toot-wrapper 🚀"

Architecture

toot-wrapper/               # This repo (forkable)
├── post.sh                 # Main script
├── README.md               # This file
└── ...

../mastodon-posts/          # Posts repository (must exist adjacent or set POSTS_REPO_DIR)
├── posts/
│   ├── 2026-04-04-1.txt
│   ├── 2026-04-04-1.txt.asc
│   └── ...
├── public-key.asc          # Your GPG public key
└── README.md

Example: r3r4um's Setup

Gitea: git.r3r4um.online
Mastodon: @r3r4um@social.r3r4um.net
Posts repo: https://git.r3r4um.online/r3r4um/mastodon-posts
GPG key: r3r4um@social.r3r4um.net (imported from public-key.asc in posts repo)

Posts are verified by cloning the repo and checking signatures against the public key.

License

Public domain / MIT. Fork freely, configure for your setup.