mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-26 20:43:46 +00:00
Artem Lytkin
c8660364d9
With SIGNING_FORMAT = ssh the OpenPGP verification path builds its GPGSettings from the instance signing key but leaves the format empty, so it runs `gpg -a --export` on an SSH public key path. Depending on the local gpg setup that either exports nothing, so an OpenPGP signed commit reports gpg.error.generate_hash instead of a missing key, or it fails outright and logs an export error for every such commit. Both guards are needed. The first covers SIGNING_KEY set to a path with SIGNING_FORMAT=ssh; the second covers the shipped default SIGNING_KEY=default, where the format comes from git's own gpg.format and never gets reconciled with the hardcoded "openpgp". Drop either one and a working config goes back to broken. Also raise minimum git version to 2.18 which was already required before this change. Fixes: https://github.com/go-gitea/gitea/issues/37452 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
34 lines
1.2 KiB
Go
34 lines
1.2 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package git
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"gitea.dev/modules/setting"
|
|
"gitea.dev/modules/test"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestGlobalCommitSignSettings(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.Git.HomePath)()
|
|
defer GlobalCommitSignSettings.Reset()
|
|
|
|
signWithGitConfig := func(gitConfig string) bool {
|
|
setting.Git.HomePath = t.TempDir()
|
|
require.NoError(t, os.WriteFile(filepath.Join(setting.Git.HomePath, ".gitconfig"), []byte(gitConfig), 0o600))
|
|
GlobalCommitSignSettings.Reset()
|
|
return GlobalCommitSignSettings.Value().Sign
|
|
}
|
|
|
|
assert.False(t, signWithGitConfig("[user]\n\tsigningkey = KEY\n"), "must not sign when commit.gpgsign is unset")
|
|
assert.True(t, signWithGitConfig("[user]\n\tsigningkey = KEY\n[commit]\n\tgpgsign = true\n"))
|
|
assert.True(t, signWithGitConfig("[user]\n\tsigningkey = KEY\n[commit]\n\tgpgsign\n"), "git reads a valueless commit.gpgsign as true")
|
|
assert.False(t, signWithGitConfig("[user]\n\tsigningkey = KEY\n[commit]\n\tgpgsign = nonsense\n"), "must not sign when git cannot parse commit.gpgsign")
|
|
}
|