Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-27 11:53:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(asymkey): do not verify OpenPGP signatures with an SSH instance key, require git 2.18 (#39073)

Browse Source 
With SIGNING_FORMAT = ssh the OpenPGP verification path builds its
GPGSettings from the instance signing key but leaves the format empty,
so it runs `gpg -a --export` on an SSH public key path. Depending on the
local gpg setup that either exports nothing, so an OpenPGP signed commit
reports gpg.error.generate_hash instead of a missing key, or it fails
outright and logs an export error for every such commit.

Both guards are needed. The first covers SIGNING_KEY set to a path with
SIGNING_FORMAT=ssh; the second covers the shipped default
SIGNING_KEY=default, where the format comes from git's own gpg.format
and never gets reconciled with the hardcoded "openpgp". Drop either one
and a working config goes back to broken.

Also raise minimum git version to 2.18 which was already required before this change.

Fixes: https://github.com/go-gitea/gitea/issues/37452
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
Artem Lytkin
2026-08-25 15:02:31 +03:00
committed by GitHub
parent d17ccd4434
commit c8660364d9
9 changed files with 184 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/git/utils.go
-28
View File
@@ -6,7 +6,6 @@ package git
import (
"crypto/sha1"
"encoding/hex"
"strconv"
"strings"
"sync"
@@ -40,33 +39,6 @@ func (oc *ObjectCache[T]) Get(id string) (T, bool) {
return obj, has
}
// ParseBool returns the boolean value represented by the string as per git's git_config_bool
// true will be returned for the result if the string is empty, but valid will be false.
// "true", "yes", "on" are all true, true
// "false", "no", "off" are all false, true
// 0 is false, true
// Any other integer is true, true
// Anything else will return false, false
func ParseBool(value string) (result, valid bool) {
// Empty strings are true but invalid
if len(value) == 0 {
return true, false
}
// These are the git expected true and false values
if strings.EqualFold(value, "true") || strings.EqualFold(value, "yes") || strings.EqualFold(value, "on") {
return true, true
}
if strings.EqualFold(value, "false") || strings.EqualFold(value, "no") || strings.EqualFold(value, "off") {
return false, true
}
// Try a number
intValue, err := strconv.ParseInt(value, 10, 32)
if err != nil {
return false, false
}
return intValue != 0, true
}
func HashFilePathForWebUI(s string) string {
h := sha1.New()
_, _ = h.Write([]byte(s))