mirrors/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-26 09:01:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(asymkey): do not verify OpenPGP signatures with an SSH instance key (#39073) (#39086)

Browse Source 
Co-authored-by: Artem Lytkin <iprintercanon@gmail.com>
This commit is contained in:
wxiaoguang
2026-08-26 03:24:22 +08:00
committed by GitHub
parent d2572c7342
commit 3f93080f48
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
services/asymkey/commit.go
View File

@@ -143,7 +143,9 @@ func parseCommitWithGPGSignature(ctx context.Context, c *git.Commit, committer *
}
}
if setting.Repository.Signing.SigningKey != "" && setting.Repository.Signing.SigningKey != "default" && setting.Repository.Signing.SigningKey != "none" {
// an SSH instance key can never verify an OpenPGP signature, and exporting its path through gpg would only yield an empty key
if setting.Repository.Signing.SigningFormat != git.SigningKeyFormatSSH &&
setting.Repository.Signing.SigningKey != "" && setting.Repository.Signing.SigningKey != "default" && setting.Repository.Signing.SigningKey != "none" {
// OK we should try the default key
gpgSettings := git.GPGSettings{
Sign: true,
@@ -167,7 +169,7 @@ func parseCommitWithGPGSignature(ctx context.Context, c *git.Commit, committer *
log.Error("Error getting default public gpg key: %v", err)
} else if defaultGPGSettings == nil {
log.Warn("Unable to get defaultGPGSettings for unattached commit: %s", c.ID.String())
} else if defaultGPGSettings.Sign {
} else if defaultGPGSettings.Sign && defaultGPGSettings.Format != git.SigningKeyFormatSSH {
if commitVerification := verifyWithGPGSettings(ctx, defaultGPGSettings, sig, c.Signature.Payload, committer, keyID); commitVerification != nil {
if commitVerification.Reason == asymkey_model.BadSignature {
defaultReason = asymkey_model.BadSignature