mirror of
https://github.com/go-gitea/gitea.git
synced 2024-12-22 17:34:03 +03:00
fcb535c5c3
This PR fixes #7598 by providing a configurable way of signing commits across the Gitea instance. Per repository configurability and import/generation of trusted secure keys is not provided by this PR - from a security PoV that's probably impossible to do properly. Similarly web-signing, that is asking the user to sign something, is not implemented - this could be done at a later stage however. ## Features - [x] If commit.gpgsign is set in .gitconfig sign commits and files created through repofiles. (merges should already have been signed.) - [x] Verify commits signed with the default gpg as valid - [x] Signer, Committer and Author can all be different - [x] Allow signer to be arbitrarily different - We still require the key to have an activated email on Gitea. A more complete implementation would be to use a keyserver and mark external-or-unactivated with an "unknown" trust level icon. - [x] Add a signing-key.gpg endpoint to get the default gpg pub key if available - Rather than add a fake web-flow user I've added this as an endpoint on /api/v1/signing-key.gpg - [x] Try to match the default key with a user on gitea - this is done at verification time - [x] Make things configurable? - app.ini configuration done - [x] when checking commits are signed need to check if they're actually verifiable too - [x] Add documentation I have decided that adjusting the docker to create a default gpg key is not the correct thing to do and therefore have not implemented this.
84 lines
2.0 KiB
INI
84 lines
2.0 KiB
INI
APP_NAME = Gitea: Git with a cup of tea
|
|
RUN_MODE = prod
|
|
|
|
[database]
|
|
DB_TYPE = sqlite3
|
|
PATH = integrations/gitea-integration-sqlite/gitea.db
|
|
|
|
[indexer]
|
|
ISSUE_INDEXER_PATH = integrations/indexers-sqlite/issues.bleve
|
|
REPO_INDEXER_ENABLED = true
|
|
REPO_INDEXER_PATH = integrations/indexers-sqlite/repos.bleve
|
|
|
|
[repository]
|
|
ROOT = integrations/gitea-integration-sqlite/gitea-repositories
|
|
|
|
[repository.local]
|
|
LOCAL_COPY_PATH = tmp/local-repo-sqlite
|
|
LOCAL_WIKI_PATH = tmp/local-wiki-sqlite
|
|
|
|
[repository.signing]
|
|
SIGNING_KEY = none
|
|
|
|
[server]
|
|
SSH_DOMAIN = localhost
|
|
HTTP_PORT = 3003
|
|
ROOT_URL = http://localhost:3003/
|
|
DISABLE_SSH = false
|
|
SSH_LISTEN_HOST = localhost
|
|
SSH_PORT = 2203
|
|
START_SSH_SERVER = true
|
|
LFS_START_SERVER = true
|
|
LFS_CONTENT_PATH = data/lfs-sqlite
|
|
OFFLINE_MODE = false
|
|
LFS_JWT_SECRET = Tv_MjmZuHqpIY6GFl12ebgkRAMt4RlWt0v4EHKSXO0w
|
|
APP_DATA_PATH = integrations/gitea-integration-sqlite/data
|
|
ENABLE_GZIP = true
|
|
BUILTIN_SSH_SERVER_USER = git
|
|
|
|
[mailer]
|
|
ENABLED = true
|
|
MAILER_TYPE = dummy
|
|
FROM = sqlite-integration-test@gitea.io
|
|
|
|
[service]
|
|
REGISTER_EMAIL_CONFIRM = false
|
|
ENABLE_NOTIFY_MAIL = true
|
|
DISABLE_REGISTRATION = false
|
|
ENABLE_CAPTCHA = false
|
|
REQUIRE_SIGNIN_VIEW = false
|
|
DEFAULT_KEEP_EMAIL_PRIVATE = false
|
|
DEFAULT_ALLOW_CREATE_ORGANIZATION = true
|
|
NO_REPLY_ADDRESS = noreply.example.org
|
|
|
|
[picture]
|
|
DISABLE_GRAVATAR = false
|
|
ENABLE_FEDERATED_AVATAR = false
|
|
|
|
[session]
|
|
PROVIDER = file
|
|
|
|
[log]
|
|
MODE = test,file
|
|
ROOT_PATH = sqlite-log
|
|
REDIRECT_MACARON_LOG = true
|
|
ROUTER = ,
|
|
MACARON = ,
|
|
XORM = file
|
|
|
|
[log.test]
|
|
LEVEL = Info
|
|
COLORIZE = true
|
|
|
|
[log.file]
|
|
LEVEL = Debug
|
|
|
|
[security]
|
|
INSTALL_LOCK = true
|
|
SECRET_KEY = 9pCviYTWSb
|
|
INTERNAL_TOKEN = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE0OTI3OTU5ODN9.OQkH5UmzID2XBdwQ9TAI6Jj2t1X-wElVTjbE7aoN4I8
|
|
|
|
[oauth2]
|
|
JWT_SECRET = KZb_QLUd4fYVyxetjxC4eZkrBgWM2SndOOWDNtgUUko
|
|
|