From 3f93080f48d8cd7a5d29ea1ade4fe4ca13d01db4 Mon Sep 17 00:00:00 2001 From: wxiaoguang Date: Wed, 26 Aug 2026 03:24:22 +0800 Subject: [PATCH] fix(asymkey): do not verify OpenPGP signatures with an SSH instance key (#39073) (#39086) Co-authored-by: Artem Lytkin --- services/asymkey/commit.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/services/asymkey/commit.go b/services/asymkey/commit.go index c10fe9d6983..21881a62d71 100644 --- a/services/asymkey/commit.go +++ b/services/asymkey/commit.go @@ -143,7 +143,9 @@ func parseCommitWithGPGSignature(ctx context.Context, c *git.Commit, committer * } } - if setting.Repository.Signing.SigningKey != "" && setting.Repository.Signing.SigningKey != "default" && setting.Repository.Signing.SigningKey != "none" { + // an SSH instance key can never verify an OpenPGP signature, and exporting its path through gpg would only yield an empty key + if setting.Repository.Signing.SigningFormat != git.SigningKeyFormatSSH && + setting.Repository.Signing.SigningKey != "" && setting.Repository.Signing.SigningKey != "default" && setting.Repository.Signing.SigningKey != "none" { // OK we should try the default key gpgSettings := git.GPGSettings{ Sign: true, @@ -167,7 +169,7 @@ func parseCommitWithGPGSignature(ctx context.Context, c *git.Commit, committer * log.Error("Error getting default public gpg key: %v", err) } else if defaultGPGSettings == nil { log.Warn("Unable to get defaultGPGSettings for unattached commit: %s", c.ID.String()) - } else if defaultGPGSettings.Sign { + } else if defaultGPGSettings.Sign && defaultGPGSettings.Format != git.SigningKeyFormatSSH { if commitVerification := verifyWithGPGSettings(ctx, defaultGPGSettings, sig, c.Signature.Payload, committer, keyID); commitVerification != nil { if commitVerification.Reason == asymkey_model.BadSignature { defaultReason = asymkey_model.BadSignature