From 79fc119641747bb43bd9a03d9fde76a1fc2947c6 Mon Sep 17 00:00:00 2001
From: k3n <k3n.solver@gmail.com>
Date: Wed, 9 Sep 2026 22:42:29 +0200
Subject: [PATCH] fix(auth): fix ssh and gpg key verification on windows
 (#39283)

Signed-off-by: Francesco Passaquindici <k3n.solver@gmail.com>
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
---
 models/asymkey/gpg_key_verify.go      | 22 +++++-----------------
 templates/user/settings/keys_gpg.tmpl | 20 ++++++++++++++++++--
 templates/user/settings/keys_ssh.tmpl |  4 ++--
 3 files changed, 25 insertions(+), 21 deletions(-)

diff --git a/models/asymkey/gpg_key_verify.go b/models/asymkey/gpg_key_verify.go
index b699a1d3cb2..77481c84e90 100644
--- a/models/asymkey/gpg_key_verify.go
+++ b/models/asymkey/gpg_key_verify.go
@@ -40,29 +40,17 @@ func VerifyGPGKey(ctx context.Context, ownerID int64, keyID, token, signature st
 			}
 		}
 
-		signer, err := hashAndVerifyWithSubKeys(sig, token, key)
-		if err != nil {
-			return "", ErrGPGInvalidTokenSignature{
-				ID:      key.KeyID,
-				Wrapped: err,
-			}
-		}
-		if signer == nil {
-			signer, err = hashAndVerifyWithSubKeys(sig, token+"\n", key)
+		var signer *GPGKey
+		for _, tokenCandidate := range []string{token, token + "\n", token + "\n\n", token + "\r\n", token + "\r\n\r\n"} {
+			signer, err = hashAndVerifyWithSubKeys(sig, tokenCandidate, key)
 			if err != nil {
 				return "", ErrGPGInvalidTokenSignature{
 					ID:      key.KeyID,
 					Wrapped: err,
 				}
 			}
-		}
-		if signer == nil {
-			signer, err = hashAndVerifyWithSubKeys(sig, token+"\n\n", key)
-			if err != nil {
-				return "", ErrGPGInvalidTokenSignature{
-					ID:      key.KeyID,
-					Wrapped: err,
-				}
+			if signer != nil {
+				break
 			}
 		}
 
diff --git a/templates/user/settings/keys_gpg.tmpl b/templates/user/settings/keys_gpg.tmpl
index 8f738d7a6fd..0589308d43b 100644
--- a/templates/user/settings/keys_gpg.tmpl
+++ b/templates/user/settings/keys_gpg.tmpl
@@ -21,7 +21,15 @@
 					<input readonly="" value="{{.TokenToSign}}">
 					<div class="help">
 						{{ctx.Locale.Tr "settings.gpg_token_help"}}
-						<pre class="command-block">{{printf `echo "%s" | gpg -a --default-key %s --detach-sig` .TokenToSign .PaddedKeyID}}</pre>
+						<pre class="command-block">echo {{.TokenToSign}} | gpg -a --default-key {{.PaddedKeyID}} --detach-sig</pre>
+						<details>
+							<summary>Windows PowerShell</summary>
+							<pre class="command-block">'{{.TokenToSign}}' | gpg -a --default-key {{.PaddedKeyID}} --detach-sig</pre>
+						</details>
+						<details>
+							<summary>Windows CMD</summary>
+							<pre class="command-block">echo {{.TokenToSign}}| gpg -a --default-key {{.PaddedKeyID}} --detach-sig</pre>
+						</details>
 					</div>
 				</div>
 				<div class="field">
@@ -88,7 +96,15 @@
 							<input readonly="" value="{{$.TokenToSign}}">
 							<div class="help">
 								{{ctx.Locale.Tr "settings.gpg_token_help"}}
-								<pre class="command-block">{{printf `echo "%s" | gpg -a --default-key %s --detach-sig` $.TokenToSign .PaddedKeyID}}</pre>
+								<pre class="command-block">echo {{$.TokenToSign}} | gpg -a --default-key {{.PaddedKeyID}} --detach-sig</pre>
+								<details>
+									<summary>Windows PowerShell</summary>
+									<pre class="command-block">'{{$.TokenToSign}}' | gpg -a --default-key {{.PaddedKeyID}} --detach-sig</pre>
+								</details>
+								<details>
+									<summary>Windows CMD</summary>
+									<pre class="command-block">echo {{$.TokenToSign}}| gpg -a --default-key {{.PaddedKeyID}} --detach-sig</pre>
+								</details>
 							</div>
 						</div>
 						<div class="field">
diff --git a/templates/user/settings/keys_ssh.tmpl b/templates/user/settings/keys_ssh.tmpl
index 5248531b08f..13796f0f93a 100644
--- a/templates/user/settings/keys_ssh.tmpl
+++ b/templates/user/settings/keys_ssh.tmpl
@@ -79,11 +79,11 @@
 								<pre class="command-block">echo -n '{{$.TokenToSign}}' | ssh-keygen -Y sign -n gitea -f /path_to_PrivateKey_or_RelatedPublicKey</pre>
 								<details>
 									<summary>Windows PowerShell</summary>
-									<pre class="command-block">cmd /c "&lt;NUL set /p=`"{{$.TokenToSign}}`"| ssh-keygen -Y sign -n gitea -f /path_to_PrivateKey_or_RelatedPublicKey"</pre>
+									<pre class="command-block">'{{$.TokenToSign}}' | ssh-keygen -Y sign -n gitea -f /path_to_PrivateKey_or_RelatedPublicKey</pre>
 								</details>
 								<details>
 									<summary>Windows CMD</summary>
-									<pre class="command-block">set /p={{$.TokenToSign}}| ssh-keygen -Y sign -n gitea -f /path_to_PrivateKey_or_RelatedPublicKey</pre>
+									<pre class="command-block">echo {{$.TokenToSign}}| ssh-keygen -Y sign -n gitea -f /path_to_PrivateKey_or_RelatedPublicKey</pre>
 								</details>
 							</div>
 						</div>