mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-26 20:43:46 +00:00
Artem Lytkin
c8660364d9
With SIGNING_FORMAT = ssh the OpenPGP verification path builds its GPGSettings from the instance signing key but leaves the format empty, so it runs `gpg -a --export` on an SSH public key path. Depending on the local gpg setup that either exports nothing, so an OpenPGP signed commit reports gpg.error.generate_hash instead of a missing key, or it fails outright and logs an export error for every such commit. Both guards are needed. The first covers SIGNING_KEY set to a path with SIGNING_FORMAT=ssh; the second covers the shipped default SIGNING_KEY=default, where the format comes from git's own gpg.format and never gets reconciled with the hardcoded "openpgp". Drop either one and a working config goes back to broken. Also raise minimum git version to 2.18 which was already required before this change. Fixes: https://github.com/go-gitea/gitea/issues/37452 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
56 lines
1.9 KiB
Go
56 lines
1.9 KiB
Go
// Copyright 2025 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package git
|
|
|
|
import (
|
|
"context"
|
|
|
|
"gitea.dev/modules/setting"
|
|
)
|
|
|
|
// Based on https://git-scm.com/docs/git-config#Documentation/git-config.txt-gpgformat
|
|
const (
|
|
SigningKeyFormatOpenPGP = "openpgp" // for GPG keys, the expected default of git cli
|
|
SigningKeyFormatSSH = "ssh"
|
|
)
|
|
|
|
// SigningKey represents an instance key info which will be used to sign git commits.
|
|
// FIXME: need to refactor it to a new name, this name conflicts with the variable names for "asymkey.GPGKey" in many places.
|
|
type SigningKey struct {
|
|
KeyID string
|
|
Format string
|
|
}
|
|
|
|
func (s *SigningKey) String() string {
|
|
// Do not expose KeyID
|
|
// In case the key is a file path and the struct is rendered in a template, then the server path will be exposed.
|
|
setting.PanicInDevOrTesting("don't call SigningKey.String() - it exposes the KeyID which might be a local file path")
|
|
return "SigningKey:" + s.Format
|
|
}
|
|
|
|
// GetSigningKey returns the KeyID and git Signature for the repo
|
|
func GetSigningKey(ctx context.Context) (*SigningKey, *Signature) {
|
|
if setting.Repository.Signing.SigningKey == "none" {
|
|
return nil, nil
|
|
}
|
|
|
|
if setting.Repository.Signing.SigningKey == "default" || setting.Repository.Signing.SigningKey == "" {
|
|
commitSignSettings := GlobalCommitSignSettings.Value()
|
|
if !commitSignSettings.Sign {
|
|
return nil, nil
|
|
}
|
|
sigKey := &SigningKey{KeyID: commitSignSettings.KeyID, Format: commitSignSettings.Format}
|
|
sig := &Signature{Name: commitSignSettings.Name, Email: commitSignSettings.Email}
|
|
return sigKey, sig
|
|
}
|
|
|
|
if setting.Repository.Signing.SigningKey == "" {
|
|
return nil, nil
|
|
}
|
|
|
|
sigKey := &SigningKey{KeyID: setting.Repository.Signing.SigningKey, Format: setting.Repository.Signing.SigningFormat}
|
|
sig := &Signature{Name: setting.Repository.Signing.SigningName, Email: setting.Repository.Signing.SigningEmail}
|
|
return sigKey, sig
|
|
}
|