Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-27 13:03:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(asymkey): do not verify OpenPGP signatures with an SSH instance key, require git 2.18 (#39073)

Browse Source 
With SIGNING_FORMAT = ssh the OpenPGP verification path builds its
GPGSettings from the instance signing key but leaves the format empty,
so it runs `gpg -a --export` on an SSH public key path. Depending on the
local gpg setup that either exports nothing, so an OpenPGP signed commit
reports gpg.error.generate_hash instead of a missing key, or it fails
outright and logs an export error for every such commit.

Both guards are needed. The first covers SIGNING_KEY set to a path with
SIGNING_FORMAT=ssh; the second covers the shipped default
SIGNING_KEY=default, where the format comes from git's own gpg.format
and never gets reconciled with the hardcoded "openpgp". Drop either one
and a working config goes back to broken.

Also raise minimum git version to 2.18 which was already required before this change.

Fixes: https://github.com/go-gitea/gitea/issues/37452
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
Artem Lytkin
2026-08-25 15:02:31 +03:00
committed by GitHub
parent d17ccd4434
commit c8660364d9
9 changed files with 184 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/asymkey/commit.go
+55 -50
View File
@@ -17,6 +17,7 @@ import (
"gitea.dev/modules/git"
"gitea.dev/modules/log"
"gitea.dev/modules/setting"
"gitea.dev/modules/util"
"github.com/42wim/sshsig"
"github.com/ProtonMail/go-crypto/openpgp/packet"
@@ -61,6 +62,31 @@ func ParseCommitWithSignatureCommitter(ctx context.Context, c *git.Commit, commi
return parseCommitWithGPGSignature(ctx, c, committer)
}
func getInstanceCommitSignSettings(fmt string) *git.CommitSignSettings {
settingFmt := util.IfZero(setting.Repository.Signing.SigningFormat, git.SigningKeyFormatOpenPGP)
if settingFmt != fmt {
return nil
}
if slices.Contains([]string{"", "default", "none"}, setting.Repository.Signing.SigningKey) {
return nil
}
return &git.CommitSignSettings{
Sign: true,
Name: setting.Repository.Signing.SigningName,
Email: setting.Repository.Signing.SigningEmail,
Format: fmt,
KeyID: setting.Repository.Signing.SigningKey,
}
}
func getGitGlobalCommitSignSettings(fmt string) *git.CommitSignSettings {
css := git.GlobalCommitSignSettings.Value()
if css.Format != fmt || !css.Sign {
return nil
}
return css
}
func parseCommitWithGPGSignature(ctx context.Context, c *git.Commit, committer *user_model.User) *asymkey_model.CommitVerification {
// Parsing signature
sig, err := asymkey_model.ExtractSignature(c.Signature.Signature)
@@ -143,37 +169,20 @@ func parseCommitWithGPGSignature(ctx context.Context, c *git.Commit, committer *
}
}
if setting.Repository.Signing.SigningKey != "" && setting.Repository.Signing.SigningKey != "default" && setting.Repository.Signing.SigningKey != "none" {
// OK we should try the default key
gpgSettings := git.GPGSettings{
Sign: true,
KeyID: setting.Repository.Signing.SigningKey,
Name: setting.Repository.Signing.SigningName,
Email: setting.Repository.Signing.SigningEmail,
}
if err := gpgSettings.LoadPublicKeyContent(); err != nil {
log.Error("Error getting default signing key: %s %v", gpgSettings.KeyID, err)
} else if commitVerification := verifyWithGPGSettings(ctx, &gpgSettings, sig, c.Signature.Payload, committer, keyID); commitVerification != nil {
if commitVerification.Reason == asymkey_model.BadSignature {
defaultReason = asymkey_model.BadSignature
} else {
if instanceSettings := getInstanceCommitSignSettings(git.SigningKeyFormatOpenPGP); instanceSettings != nil {
if commitVerification := verifyCommitSignByGPGSettings(ctx, instanceSettings, sig, c.Signature.Payload, committer, keyID); commitVerification != nil {
if commitVerification.Reason != asymkey_model.BadSignature {
return commitVerification
}
defaultReason = commitVerification.Reason
}
}
defaultGPGSettings, err := git.GetDefaultPublicGPGKey(ctx, false)
if err != nil {
log.Error("Error getting default public gpg key: %v", err)
} else if defaultGPGSettings == nil {
log.Warn("Unable to get defaultGPGSettings for unattached commit: %s", c.ID.String())
} else if defaultGPGSettings.Sign {
if commitVerification := verifyWithGPGSettings(ctx, defaultGPGSettings, sig, c.Signature.Payload, committer, keyID); commitVerification != nil {
if commitVerification.Reason == asymkey_model.BadSignature {
defaultReason = asymkey_model.BadSignature
} else {
if globalSettings := getGitGlobalCommitSignSettings(git.SigningKeyFormatOpenPGP); globalSettings != nil {
if commitVerification := verifyCommitSignByGPGSettings(ctx, globalSettings, sig, c.Signature.Payload, committer, keyID); commitVerification != nil {
if commitVerification.Reason != asymkey_model.BadSignature {
return commitVerification
}
defaultReason = commitVerification.Reason
}
}
@@ -182,9 +191,7 @@ func parseCommitWithGPGSignature(ctx context.Context, c *git.Commit, committer *
Verified: false,
Warning: defaultReason != asymkey_model.NoKeyFound,
Reason: defaultReason,
SigningKey: &asymkey_model.GPGKey{
KeyID: keyID,
},
SigningKey: &asymkey_model.GPGKey{KeyID: keyID},
}
}
@@ -280,17 +287,23 @@ func HashAndVerifyForKeyID(ctx context.Context, sig *packet.Signature, payload s
Verified: false,
Warning: true,
Reason: asymkey_model.BadSignature,
SigningKey: &asymkey_model.GPGKey{KeyID: keyID},
}
}
func verifyWithGPGSettings(ctx context.Context, gpgSettings *git.GPGSettings, sig *packet.Signature, payload string, committer *user_model.User, keyID string) *asymkey_model.CommitVerification {
func verifyCommitSignByGPGSettings(ctx context.Context, gpgSettings *git.CommitSignSettings, sig *packet.Signature, payload string, committer *user_model.User, keyID string) *asymkey_model.CommitVerification {
// First try to find the key in the db
if commitVerification := HashAndVerifyForKeyID(ctx, sig, payload, committer, gpgSettings.KeyID, gpgSettings.Name, gpgSettings.Email); commitVerification != nil {
return commitVerification
}
// Otherwise we have to parse the key
ekeys, err := asymkey_model.CheckArmoredGPGKeyString(gpgSettings.PublicKeyContent)
pubKeyContent, err := gpgSettings.PublicKeyContent()
if err != nil {
log.Error("gpgSettings.PublicKeyContent: %v", err)
return nil
}
ekeys, err := asymkey_model.CheckArmoredGPGKeyString(pubKeyContent)
if err != nil {
log.Error("Unable to get default signing key: %v", err)
return &asymkey_model.CommitVerification{
@@ -342,13 +355,14 @@ func verifyWithGPGSettings(ctx context.Context, gpgSettings *git.GPGSettings, si
Verified: false,
Warning: true,
Reason: asymkey_model.BadSignature,
SigningKey: &asymkey_model.GPGKey{KeyID: keyID},
}
}
}
return nil
}
func verifySSHCommitVerificationByInstanceKey(c *git.Commit, committerUser, signerUser *user_model.User, committerGitEmail, publicKeyContent string) *asymkey_model.CommitVerification {
func verifyCommitSignBySSHSettings(c *git.Commit, committerUser, signerUser *user_model.User, committerGitEmail, publicKeyContent string) *asymkey_model.CommitVerification {
fingerprint, err := asymkey_model.CalcFingerprint(publicKeyContent)
if err != nil {
log.Error("Error calculating the fingerprint public key %q, err: %v", publicKeyContent, err)
@@ -360,7 +374,7 @@ func verifySSHCommitVerificationByInstanceKey(c *git.Commit, committerUser, sign
Fingerprint: fingerprint,
HasUsed: true,
}
return verifySSHCommitVerification(c.Signature.Signature, c.Signature.Payload, sshPubKey, committerUser, signerUser, committerGitEmail)
return verifyCommitSignBySSHPublicKey(c.Signature.Signature, c.Signature.Payload, sshPubKey, committerUser, signerUser, committerGitEmail)
}
// parseCommitWithSSHSignature check if signature is good against keystore.
@@ -382,7 +396,7 @@ func parseCommitWithSSHSignature(ctx context.Context, c *git.Commit, committerUs
for _, k := range keys {
if k.Verified {
commitVerification := verifySSHCommitVerification(c.Signature.Signature, c.Signature.Payload, k, committerUser, committerUser, c.Committer.Email)
commitVerification := verifyCommitSignBySSHPublicKey(c.Signature.Signature, c.Signature.Payload, k, committerUser, committerUser, c.Committer.Email)
if commitVerification != nil {
return commitVerification
}
@@ -398,29 +412,20 @@ func parseCommitWithSSHSignature(ctx context.Context, c *git.Commit, committerUs
Name: setting.Repository.Signing.SigningName,
Email: setting.Repository.Signing.SigningEmail,
}
commitVerification := verifySSHCommitVerificationByInstanceKey(c, committerUser, signerUser, c.Committer.Email, k)
commitVerification := verifyCommitSignBySSHSettings(c, committerUser, signerUser, c.Committer.Email, k)
if commitVerification != nil && commitVerification.Verified {
return commitVerification
}
}
// Try the configured instance-wide SSH public key
if setting.Repository.Signing.SigningFormat == git.SigningKeyFormatSSH && !slices.Contains([]string{"", "default", "none"}, setting.Repository.Signing.SigningKey) {
gpgSettings := git.GPGSettings{
Sign: true,
KeyID: setting.Repository.Signing.SigningKey,
Name: setting.Repository.Signing.SigningName,
Email: setting.Repository.Signing.SigningEmail,
Format: setting.Repository.Signing.SigningFormat,
}
signerUser := &user_model.User{
Name: gpgSettings.Name,
Email: gpgSettings.Email,
}
if err := gpgSettings.LoadPublicKeyContent(); err != nil {
log.Error("Error getting instance-wide SSH signing key %q, err: %v", gpgSettings.KeyID, err)
if instanceSettings := getInstanceCommitSignSettings(git.SigningKeyFormatSSH); instanceSettings != nil {
pubKeyContent, err := instanceSettings.PublicKeyContent()
if err != nil {
log.Error("commitSignSettings.PublicKeyContent: %v", err)
} else {
commitVerification := verifySSHCommitVerificationByInstanceKey(c, committerUser, signerUser, gpgSettings.Email, gpgSettings.PublicKeyContent)
signerUser := &user_model.User{Name: instanceSettings.Name, Email: instanceSettings.Email}
commitVerification := verifyCommitSignBySSHSettings(c, committerUser, signerUser, instanceSettings.Email, pubKeyContent)
if commitVerification != nil && commitVerification.Verified {
return commitVerification
}
@@ -434,7 +439,7 @@ func parseCommitWithSSHSignature(ctx context.Context, c *git.Commit, committerUs
}
}
func verifySSHCommitVerification(sig, payload string, k *asymkey_model.PublicKey, committer, signer *user_model.User, email string) *asymkey_model.CommitVerification {
func verifyCommitSignBySSHPublicKey(sig, payload string, k *asymkey_model.PublicKey, committer, signer *user_model.User, email string) *asymkey_model.CommitVerification {
if err := sshsig.Verify(strings.NewReader(payload), []byte(sig), []byte(k.Content), "git"); err != nil {
return nil
}
services/asymkey/commit_test.go
+34
View File
@@ -19,6 +19,40 @@ import (
"github.com/stretchr/testify/require"
)
func TestCommitSignSettings(t *testing.T) {
defer test.MockVariableValue(&setting.Repository.Signing.SigningFormat)()
defer test.MockVariableValue(&setting.Repository.Signing.SigningKey, "any-content")()
t.Run("InstanceSettings", func(t *testing.T) {
setting.Repository.Signing.SigningFormat = ""
css := getInstanceCommitSignSettings(git.SigningKeyFormatOpenPGP)
assert.NotNil(t, css)
assert.Equal(t, git.SigningKeyFormatOpenPGP, css.Format)
css = getInstanceCommitSignSettings(git.SigningKeyFormatSSH)
assert.Nil(t, css)
setting.Repository.Signing.SigningFormat = git.SigningKeyFormatOpenPGP
css = getInstanceCommitSignSettings(git.SigningKeyFormatOpenPGP)
assert.NotNil(t, css)
assert.Equal(t, git.SigningKeyFormatOpenPGP, css.Format)
setting.Repository.Signing.SigningFormat = git.SigningKeyFormatSSH
css = getInstanceCommitSignSettings(git.SigningKeyFormatSSH)
assert.NotNil(t, css)
assert.Equal(t, git.SigningKeyFormatSSH, css.Format)
css = getInstanceCommitSignSettings(git.SigningKeyFormatOpenPGP)
assert.Nil(t, css)
})
t.Run("GitGlobalSettings", func(t *testing.T) {
css := git.GlobalCommitSignSettings.Value()
assert.False(t, css.Sign)
assert.Equal(t, git.SigningKeyFormatOpenPGP, css.Format)
css = getGitGlobalCommitSignSettings(git.SigningKeyFormatOpenPGP)
assert.Nil(t, css)
})
}
func TestParseCommitWithSSHSignature(t *testing.T) {
assert.NoError(t, unittest.PrepareTestDatabase())