gitea

mirror of https://github.com/go-gitea/gitea.git synced 2026-05-21 12:24:10 +00:00

Files

Nicolas 1c2d5e9b03 fix(actions): make artifact signature payloads unambiguous (#37707 ) (#37795 )

This PR hardens artifact URL signing by encoding signature inputs in an
unambiguous binary payload before computing the HMAC.

What it changes:

- replace direct concatenation-style signing inputs with explicit
payload builders
- encode string fields with a length prefix before appending their bytes
- encode integer fields as fixed-width binary values instead of decimal
text
- apply the same hardening to both:
  - Actions Artifact V4 signing in `routers/api/actions/artifactsv4.go`
  - artifact download signing in `routers/api/v1/repo/action.go`
- add regression tests that verify distinct field combinations produce
distinct payloads and signatures

Why:

The previous signing logic built HMAC inputs by appending multiple
fields without a strongly structured representation. That kind of
construction can create ambiguity at field boundaries, where different
parameter combinations may serialize into the same byte stream for
signing.

This change removes that ambiguity by constructing a deterministic
payload format with explicit boundaries between fields.

Backport #37707

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>

2026-05-20 17:16:21 +00:00

jobparser

fix(actions): prevent panic when workflow contains null jobs (#37570 ) (#37576 )

2026-05-07 02:31:49 +00:00

artifacts_test.go

fix(actions): make artifact signature payloads unambiguous (#37707 ) (#37795 )

2026-05-20 17:16:21 +00:00

artifacts.go

fix(actions): make artifact signature payloads unambiguous (#37707 ) (#37795 )

2026-05-20 17:16:21 +00:00

github_test.go

Improve the issue_comment workflow trigger event (#29277 )