ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-26 05:19:44 +09:00
Code Issues Projects Releases Wiki Activity

fix(asymkey): do not verify OpenPGP signatures with an SSH instance key, require git 2.18 (#39073)

Browse Source 
With SIGNING_FORMAT = ssh the OpenPGP verification path builds its
GPGSettings from the instance signing key but leaves the format empty,
so it runs `gpg -a --export` on an SSH public key path. Depending on the
local gpg setup that either exports nothing, so an OpenPGP signed commit
reports gpg.error.generate_hash instead of a missing key, or it fails
outright and logs an export error for every such commit.

Both guards are needed. The first covers SIGNING_KEY set to a path with
SIGNING_FORMAT=ssh; the second covers the shipped default
SIGNING_KEY=default, where the format comes from git's own gpg.format
and never gets reconciled with the hardcoded "openpgp". Drop either one
and a working config goes back to broken.

Also raise minimum git version to 2.18 which was already required before this change.

Fixes: https://github.com/go-gitea/gitea/issues/37452
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
Artem Lytkin
2026-08-25 12:02:31 +00:00
committed by GitHub
co-authored by wxiaoguang silverwind
parent d17ccd4434
commit c8660364d9
9 changed files with 184 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/git/config.go
+10 -10
View File
@@ -42,16 +42,16 @@ func syncGitConfig(ctx context.Context) (err error) {
return err
}
if DefaultFeatures().CheckVersionAtLeast("2.18") {
if err := configSet(ctx, "core.commitGraph", "true"); err != nil {
return err
}
if err := configSet(ctx, "gc.writeCommitGraph", "true"); err != nil {
return err
}
if err := configSet(ctx, "fetch.writeCommitGraph", "true"); err != nil {
return err
}
if err := configSet(ctx, "core.commitGraph", "true"); err != nil {
return err
}
if err := configSet(ctx, "gc.writeCommitGraph", "true"); err != nil {
return err
}
if err := configSet(ctx, "fetch.writeCommitGraph", "true"); err != nil {
return err
}
if DefaultFeatures().SupportProcReceive {
modules/git/git.go
+1 -1
View File
@@ -24,7 +24,7 @@ import (
"github.com/hashicorp/go-version"
)
const RequiredVersion = "2.13.0" // the minimum Git version required
const RequiredVersion = "2.18.0" // the minimum Git version required
type Features struct {
gitVersion *version.Version
modules/git/gpg.go
+45 -69
View File
@@ -9,94 +9,70 @@ import (
"fmt"
"os"
"strings"
"sync"
"sync/atomic"
"gitea.dev/modules/git/gitcmd"
"gitea.dev/modules/process"
"gitea.dev/modules/util"
)
// GPGSettings represents the default GPG settings for this repository
type GPGSettings struct {
Sign bool
KeyID string
Email string
Name string
PublicKeyContent string
Format string
type CommitSignSettings struct {
Sign bool
Email string
Name string
Format string // default to GPG
KeyID string // GPG key id or SSH key file
cachedPublicKeyContent atomic.Pointer[string]
}
// LoadPublicKeyContent will load the key from gpg
func (gpgSettings *GPGSettings) LoadPublicKeyContent() error {
if gpgSettings.PublicKeyContent != "" {
return nil
func (css *CommitSignSettings) PublicKeyContent() (string, error) {
cached := css.cachedPublicKeyContent.Load()
if cached != nil {
return *cached, nil
}
if gpgSettings.Format == SigningKeyFormatSSH {
content, err := os.ReadFile(gpgSettings.KeyID)
if css.Format == SigningKeyFormatSSH {
content, err := os.ReadFile(css.KeyID)
if err != nil {
return fmt.Errorf("unable to read SSH public key file: %s, %w", gpgSettings.KeyID, err)
return "", fmt.Errorf("unable to read SSH public key file: %s, %w", css.KeyID, err)
}
gpgSettings.PublicKeyContent = string(content)
return nil
s := string(content)
css.cachedPublicKeyContent.Store(&s)
return s, nil
}
content, stderr, err := process.GetManager().Exec(
"gpg -a --export",
"gpg", "-a", "--export", gpgSettings.KeyID)
content, stderr, err := process.GetManager().Exec("gpg -a --export", "gpg", "-a", "--export", css.KeyID)
if err != nil {
return fmt.Errorf("unable to get default signing key: %s, %s, %w", gpgSettings.KeyID, stderr, err)
return "", fmt.Errorf("unable to get default signing key: %s, %s, %w", css.KeyID, stderr, err)
}
gpgSettings.PublicKeyContent = content
return nil
css.cachedPublicKeyContent.Store(&content)
return content, nil
}
var (
loadPublicGPGKeyMutex sync.RWMutex
globalGPGSettings *GPGSettings
)
var GlobalCommitSignSettings = util.OnceValue[*CommitSignSettings]{
Func: func() *CommitSignSettings {
ctx := context.Background()
css := &CommitSignSettings{}
// GetDefaultPublicGPGKey will return and cache the default public GPG settings
func GetDefaultPublicGPGKey(ctx context.Context, forceUpdate bool) (*GPGSettings, error) {
if !forceUpdate {
loadPublicGPGKeyMutex.RLock()
if globalGPGSettings != nil {
defer loadPublicGPGKeyMutex.RUnlock()
return globalGPGSettings, nil
}
loadPublicGPGKeyMutex.RUnlock()
}
// all errors are ignored because the keys might not exist
// "--type=bool" resolves a valueless "commit.gpgsign" to true
value, _, _ := gitcmd.NewCommand("config", "--global", "--default", "false", "--type=bool", "--get", "commit.gpgsign").RunStdString(ctx)
css.Sign = strings.TrimSpace(value) == "true"
loadPublicGPGKeyMutex.Lock()
defer loadPublicGPGKeyMutex.Unlock()
signingKey, _, _ := gitcmd.NewCommand("config", "--global", "--get", "user.signingkey").RunStdString(ctx)
css.KeyID = strings.TrimSpace(signingKey)
css.Sign = css.Sign && css.KeyID != ""
if globalGPGSettings != nil && !forceUpdate {
return globalGPGSettings, nil
}
format, _, _ := gitcmd.NewCommand("config", "--global", "--default", SigningKeyFormatOpenPGP, "--get", "gpg.format").RunStdString(ctx)
css.Format = strings.TrimSpace(format)
globalGPGSettings = &GPGSettings{
Sign: true,
}
defaultEmail, _, _ := gitcmd.NewCommand("config", "--global", "--get", "user.email").RunStdString(ctx)
css.Email = strings.TrimSpace(defaultEmail)
value, _, _ := gitcmd.NewCommand("config", "--global", "--get", "commit.gpgsign").RunStdString(ctx)
sign, valid := ParseBool(strings.TrimSpace(value))
if !sign || !valid {
globalGPGSettings.Sign = false
return globalGPGSettings, nil
}
signingKey, _, _ := gitcmd.NewCommand("config", "--global", "--get", "user.signingkey").RunStdString(ctx)
globalGPGSettings.KeyID = strings.TrimSpace(signingKey)
format, _, _ := gitcmd.NewCommand("config", "--global", "--default", SigningKeyFormatOpenPGP, "--get", "gpg.format").RunStdString(ctx)
globalGPGSettings.Format = strings.TrimSpace(format)
defaultEmail, _, _ := gitcmd.NewCommand("config", "--global", "--get", "user.email").RunStdString(ctx)
globalGPGSettings.Email = strings.TrimSpace(defaultEmail)
defaultName, _, _ := gitcmd.NewCommand("config", "--global", "--get", "user.name").RunStdString(ctx)
globalGPGSettings.Name = strings.TrimSpace(defaultName)
if err := globalGPGSettings.LoadPublicKeyContent(); err != nil {
return nil, err
}
return globalGPGSettings, nil
defaultName, _, _ := gitcmd.NewCommand("config", "--global", "--get", "user.name").RunStdString(ctx)
css.Name = strings.TrimSpace(defaultName)
return css
},
}
modules/git/gpg_test.go
+33
View File
@@ -0,0 +1,33 @@
// Copyright 2026 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package git
import (
"os"
"path/filepath"
"testing"
"gitea.dev/modules/setting"
"gitea.dev/modules/test"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestGlobalCommitSignSettings(t *testing.T) {
defer test.MockVariableValue(&setting.Git.HomePath)()
defer GlobalCommitSignSettings.Reset()
signWithGitConfig := func(gitConfig string) bool {
setting.Git.HomePath = t.TempDir()
require.NoError(t, os.WriteFile(filepath.Join(setting.Git.HomePath, ".gitconfig"), []byte(gitConfig), 0o600))
GlobalCommitSignSettings.Reset()
return GlobalCommitSignSettings.Value().Sign
}
assert.False(t, signWithGitConfig("[user]\n\tsigningkey = KEY\n"), "must not sign when commit.gpgsign is unset")
assert.True(t, signWithGitConfig("[user]\n\tsigningkey = KEY\n[commit]\n\tgpgsign = true\n"))
assert.True(t, signWithGitConfig("[user]\n\tsigningkey = KEY\n[commit]\n\tgpgsign\n"), "git reads a valueless commit.gpgsign as true")
assert.False(t, signWithGitConfig("[user]\n\tsigningkey = KEY\n[commit]\n\tgpgsign = nonsense\n"), "must not sign when git cannot parse commit.gpgsign")
}
modules/git/key.go
+4 -18
View File
@@ -5,9 +5,7 @@ package git
import (
"context"
"strings"
"gitea.dev/modules/git/gitcmd"
"gitea.dev/modules/setting"
)
@@ -38,24 +36,12 @@ func GetSigningKey(ctx context.Context) (*SigningKey, *Signature) {
}
if setting.Repository.Signing.SigningKey == "default" || setting.Repository.Signing.SigningKey == "" {
// Can ignore the error here as it means that commit.gpgsign is not set
value, _, _ := gitcmd.NewCommand("config", "--global", "--get", "commit.gpgsign").RunStdString(ctx)
sign, valid := ParseBool(strings.TrimSpace(value))
if !sign || !valid {
commitSignSettings := GlobalCommitSignSettings.Value()
if !commitSignSettings.Sign {
return nil, nil
}
format, _, _ := gitcmd.NewCommand("config", "--global", "--default", SigningKeyFormatOpenPGP, "--get", "gpg.format").RunStdString(ctx)
signingKey, _, _ := gitcmd.NewCommand("config", "--global", "--get", "user.signingkey").RunStdString(ctx)
signingName, _, _ := gitcmd.NewCommand("config", "--global", "--get", "user.name").RunStdString(ctx)
signingEmail, _, _ := gitcmd.NewCommand("config", "--global", "--get", "user.email").RunStdString(ctx)
if strings.TrimSpace(signingKey) == "" {
return nil, nil
}
sigKey := &SigningKey{KeyID: strings.TrimSpace(signingKey), Format: strings.TrimSpace(format)}
sig := &Signature{Name: strings.TrimSpace(signingName), Email: strings.TrimSpace(signingEmail)}
sigKey := &SigningKey{KeyID: commitSignSettings.KeyID, Format: commitSignSettings.Format}
sig := &Signature{Name: commitSignSettings.Name, Email: commitSignSettings.Email}
return sigKey, sig
}
modules/git/repo_commitgraph.go
+2 -5
View File
@@ -11,12 +11,9 @@ import (
)
// WriteCommitGraph write commit graph to speed up repo access
// this requires git v2.18 to be installed
func WriteCommitGraph(ctx context.Context, repo RepositoryFacade) error {
if DefaultFeatures().CheckVersionAtLeast("2.18") {
if _, _, err := gitcmd.NewCommand("commit-graph", "write").WithRepo(repo).RunStdString(ctx); err != nil {
return fmt.Errorf("unable to write commit-graph for '%s' : %w", repo.GitRepoLocation(), err)
}
if _, _, err := gitcmd.NewCommand("commit-graph", "write").WithRepo(repo).RunStdString(ctx); err != nil {
return fmt.Errorf("unable to write commit-graph for '%s' : %w", repo.GitRepoLocation(), err)
}
return nil
}
modules/git/utils.go
-28
View File
@@ -6,7 +6,6 @@ package git
import (
"crypto/sha1"
"encoding/hex"
"strconv"
"strings"
"sync"
@@ -40,33 +39,6 @@ func (oc *ObjectCache[T]) Get(id string) (T, bool) {
return obj, has
}
// ParseBool returns the boolean value represented by the string as per git's git_config_bool
// true will be returned for the result if the string is empty, but valid will be false.
// "true", "yes", "on" are all true, true
// "false", "no", "off" are all false, true
// 0 is false, true
// Any other integer is true, true
// Anything else will return false, false
func ParseBool(value string) (result, valid bool) {
// Empty strings are true but invalid
if len(value) == 0 {
return true, false
}
// These are the git expected true and false values
if strings.EqualFold(value, "true") || strings.EqualFold(value, "yes") || strings.EqualFold(value, "on") {
return true, true
}
if strings.EqualFold(value, "false") || strings.EqualFold(value, "no") || strings.EqualFold(value, "off") {
return false, true
}
// Try a number
intValue, err := strconv.ParseInt(value, 10, 32)
if err != nil {
return false, false
}
return intValue != 0, true
}
func HashFilePathForWebUI(s string) string {
h := sha1.New()
_, _ = h.Write([]byte(s))