You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

89 lines
2.4 KiB

Sign merges, CRUD, Wiki and Repository initialisation with gpg key (#7631) This PR fixes #7598 by providing a configurable way of signing commits across the Gitea instance. Per repository configurability and import/generation of trusted secure keys is not provided by this PR - from a security PoV that's probably impossible to do properly. Similarly web-signing, that is asking the user to sign something, is not implemented - this could be done at a later stage however. ## Features - [x] If commit.gpgsign is set in .gitconfig sign commits and files created through repofiles. (merges should already have been signed.) - [x] Verify commits signed with the default gpg as valid - [x] Signer, Committer and Author can all be different - [x] Allow signer to be arbitrarily different - We still require the key to have an activated email on Gitea. A more complete implementation would be to use a keyserver and mark external-or-unactivated with an "unknown" trust level icon. - [x] Add a signing-key.gpg endpoint to get the default gpg pub key if available - Rather than add a fake web-flow user I've added this as an endpoint on /api/v1/signing-key.gpg - [x] Try to match the default key with a user on gitea - this is done at verification time - [x] Make things configurable? - app.ini configuration done - [x] when checking commits are signed need to check if they're actually verifiable too - [x] Add documentation I have decided that adjusting the docker to create a default gpg key is not the correct thing to do and therefore have not implemented this.
5 years ago
  1. APP_NAME = Gitea: Git with a cup of tea
  2. RUN_MODE = prod
  3. [database]
  4. DB_TYPE = sqlite3
  5. PATH = integrations/gitea-integration-sqlite/gitea.db
  6. [indexer]
  7. ISSUE_INDEXER_PATH = integrations/indexers-sqlite/issues.bleve
  8. REPO_INDEXER_ENABLED = true
  9. REPO_INDEXER_PATH = integrations/indexers-sqlite/repos.bleve
  10. [repository]
  11. ROOT = {{REPO_TEST_DIR}}integrations/gitea-integration-sqlite/gitea-repositories
  12. [repository.local]
  13. LOCAL_COPY_PATH = tmp/local-repo-sqlite
  14. LOCAL_WIKI_PATH = tmp/local-wiki-sqlite
  15. [repository.signing]
  16. SIGNING_KEY = none
  17. [server]
  18. SSH_DOMAIN = localhost
  19. HTTP_PORT = 3003
  20. ROOT_URL = http://localhost:3003/
  21. DISABLE_SSH = false
  22. SSH_LISTEN_HOST = localhost
  23. SSH_PORT = 2203
  24. START_SSH_SERVER = true
  25. LFS_START_SERVER = true
  26. LFS_CONTENT_PATH = integrations/gitea-integration-sqlite/data
  27. OFFLINE_MODE = false
  28. LFS_JWT_SECRET = Tv_MjmZuHqpIY6GFl12ebgkRAMt4RlWt0v4EHKSXO0w
  29. APP_DATA_PATH = integrations/gitea-integration-sqlite/data
  30. ENABLE_GZIP = true
  31. BUILTIN_SSH_SERVER_USER = git
  32. [attachment]
  33. PATH = integrations/gitea-integration-sqlite/data
  34. [mailer]
  35. ENABLED = true
  36. MAILER_TYPE = dummy
  37. FROM = sqlite-integration-test@gitea.io
  38. [service]
  39. REGISTER_EMAIL_CONFIRM = false
  40. ENABLE_NOTIFY_MAIL = true
  41. DISABLE_REGISTRATION = false
  42. ENABLE_CAPTCHA = false
  43. REQUIRE_SIGNIN_VIEW = false
  44. DEFAULT_KEEP_EMAIL_PRIVATE = false
  45. DEFAULT_ALLOW_CREATE_ORGANIZATION = true
  46. NO_REPLY_ADDRESS = noreply.example.org
  47. [picture]
  48. DISABLE_GRAVATAR = false
  49. ENABLE_FEDERATED_AVATAR = false
  50. AVATAR_UPLOAD_PATH = integrations/gitea-integration-sqlite/data/avatars
  51. REPOSITORY_AVATAR_UPLOAD_PATH = integrations/gitea-integration-sqlite/data/repo-avatars
  52. [session]
  53. PROVIDER = file
  54. PROVIDER_CONFIG = integrations/gitea-integration-sqlite/data/sessions
  55. [log]
  56. MODE = test,file
  57. ROOT_PATH = sqlite-log
  58. REDIRECT_MACARON_LOG = true
  59. ROUTER = ,
  60. MACARON = ,
  61. XORM = file
  62. [log.test]
  63. LEVEL = Info
  64. COLORIZE = true
  65. [log.file]
  66. LEVEL = Debug
  67. [security]
  68. INSTALL_LOCK = true
  69. SECRET_KEY = 9pCviYTWSb
  70. INTERNAL_TOKEN = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE0OTI3OTU5ODN9.OQkH5UmzID2XBdwQ9TAI6Jj2t1X-wElVTjbE7aoN4I8
  71. [oauth2]
  72. JWT_SECRET = KZb_QLUd4fYVyxetjxC4eZkrBgWM2SndOOWDNtgUUko