Try to pull PGP keys from a keyserver #10620

New Issue

GiteaMirror · 2025-11-02T09:12:55-06:00

GiteaMirror commented

2025-11-02 09:12:55 -06:00

Originally created by @dsseng on GitHub (Apr 8, 2023).

Feature Description

In many cases like mirroring or forking, commiters are not registered on the instance their commits are stored on. This causes Unverified label to be present.

We could try to obtain public keys from some key servers returning verified publickeys linked to an email address, like https://keys.openpgp.org (or organisation-specific one). This should be optional and up to instance administrator to decide, because some people might not have enough trust in keyservers (or simply not need such a feature). An option might be to mark commits as partially verified unless user adds their key into Gitea profile.

In case of federation, pulling trusted keys from other instances should also be possible.

Screenshots

No response

Originally created by @dsseng on GitHub (Apr 8, 2023). ### Feature Description In many cases like mirroring or forking, commiters are not registered on the instance their commits are stored on. This causes `Unverified` label to be present. We could try to obtain public keys from some key servers returning verified publickeys linked to an email address, like https://keys.openpgp.org (or organisation-specific one). This should be optional and up to instance administrator to decide, because some people might not have enough trust in keyservers (or simply not need such a feature). An option might be to mark commits as partially verified unless user adds their key into Gitea profile. In case of federation, pulling trusted keys from other instances should also be possible. ### Screenshots _No response_

GiteaMirror added the type/proposal type/feature labels 2025-11-02 09:12:55 -06:00

GiteaMirror commented

2025-11-02 09:12:56 -06:00

@nedko commented on GitHub (May 28, 2023):

It will be useful if Gitea administrator is given (Web) UI option to import PGP keys automatically or manually. A GnuPG key-ring for a particular Gitea Instance could do it I guess. With Unverified and PartiallyVerified states mapped to GnuPG trust model states. Or maybe make one key-ring per Organization, so to manage trust per Organization. Fetching of keys from a key-server can still be per Gitea instance in this case, just harder to implement, I guess.

@nedko commented on GitHub (May 28, 2023): It will be useful if Gitea administrator is given (Web) UI option to import PGP keys automatically or manually. A GnuPG key-ring for a particular Gitea Instance could do it I guess. With Unverified and PartiallyVerified states mapped to GnuPG trust model states. Or maybe make one key-ring per Organization, so to manage trust per Organization. Fetching of keys from a key-server can still be per Gitea instance in this case, just harder to implement, I guess.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#10620