Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-27 08:23:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(asymkey): do not verify OpenPGP signatures with an SSH instance key, require git 2.18 (#39073)

Browse Source 
With SIGNING_FORMAT = ssh the OpenPGP verification path builds its
GPGSettings from the instance signing key but leaves the format empty,
so it runs `gpg -a --export` on an SSH public key path. Depending on the
local gpg setup that either exports nothing, so an OpenPGP signed commit
reports gpg.error.generate_hash instead of a missing key, or it fails
outright and logs an export error for every such commit.

Both guards are needed. The first covers SIGNING_KEY set to a path with
SIGNING_FORMAT=ssh; the second covers the shipped default
SIGNING_KEY=default, where the format comes from git's own gpg.format
and never gets reconciled with the hardcoded "openpgp". Drop either one
and a working config goes back to broken.

Also raise minimum git version to 2.18 which was already required before this change.

Fixes: https://github.com/go-gitea/gitea/issues/37452
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
Artem Lytkin
2026-08-25 15:02:31 +03:00
committed by GitHub
parent d17ccd4434
commit c8660364d9
9 changed files with 184 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/git/key.go
+4 -18
View File
@@ -5,9 +5,7 @@ package git
import (
"context"
"strings"
"gitea.dev/modules/git/gitcmd"
"gitea.dev/modules/setting"
)
@@ -38,24 +36,12 @@ func GetSigningKey(ctx context.Context) (*SigningKey, *Signature) {
}
if setting.Repository.Signing.SigningKey == "default" || setting.Repository.Signing.SigningKey == "" {
// Can ignore the error here as it means that commit.gpgsign is not set
value, _, _ := gitcmd.NewCommand("config", "--global", "--get", "commit.gpgsign").RunStdString(ctx)
sign, valid := ParseBool(strings.TrimSpace(value))
if !sign || !valid {
commitSignSettings := GlobalCommitSignSettings.Value()
if !commitSignSettings.Sign {
return nil, nil
}
format, _, _ := gitcmd.NewCommand("config", "--global", "--default", SigningKeyFormatOpenPGP, "--get", "gpg.format").RunStdString(ctx)
signingKey, _, _ := gitcmd.NewCommand("config", "--global", "--get", "user.signingkey").RunStdString(ctx)
signingName, _, _ := gitcmd.NewCommand("config", "--global", "--get", "user.name").RunStdString(ctx)
signingEmail, _, _ := gitcmd.NewCommand("config", "--global", "--get", "user.email").RunStdString(ctx)
if strings.TrimSpace(signingKey) == "" {
return nil, nil
}
sigKey := &SigningKey{KeyID: strings.TrimSpace(signingKey), Format: strings.TrimSpace(format)}
sig := &Signature{Name: strings.TrimSpace(signingName), Email: strings.TrimSpace(signingEmail)}
sigKey := &SigningKey{KeyID: commitSignSettings.KeyID, Format: commitSignSettings.Format}
sig := &Signature{Name: commitSignSettings.Name, Email: commitSignSettings.Email}
return sigKey, sig
}