gravatar has changed hash to sha256 #14410

New Issue

GiteaMirror · 2025-11-02T11:12:15-06:00

GiteaMirror commented

2025-11-02 11:12:15 -06:00

Originally created by @ppc52776 on GitHub (Apr 25, 2025).

Description

gitea can't get avatar from gravatar, the log shows
2025/04/25 18:00:44 routers/web/base.go:80:func2() [W] Unable to find avatars 0f67de64ebe46c139b7d9f3c56732507

The gravatar has changed the avatar url's hash code to sha256: https://gravatar.com/avatar/{sha256}
but the libravatar still using md5 hash.

See the example at developer part:
https://gravatar.com/

Gitea Version

1.23.7

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

docker

Database

None

Originally created by @ppc52776 on GitHub (Apr 25, 2025). ### Description gitea can't get avatar from gravatar, the log shows `2025/04/25 18:00:44 routers/web/base.go:80:func2() [W] Unable to find avatars 0f67de64ebe46c139b7d9f3c56732507` The gravatar has changed the avatar url's hash code to sha256: `https://gravatar.com/avatar/{sha256}` but the `libravatar` still using `md5` hash. See the example at developer part: https://gravatar.com/ ### Gitea Version 1.23.7 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? docker ### Database None

GiteaMirror added the type/bug type/upstream labels 2025-11-02 11:12:15 -06:00

GiteaMirror commented

2025-11-02 11:12:15 -06:00

@wxiaoguang commented on GitHub (Apr 25, 2025):

but the libravatar still using md5 hash.

libravatar is introduced by https://github.com/gogs/gogs/pull/3320 and maintained by @strk, do you have ideas about how to correct it?

@wxiaoguang commented on GitHub (Apr 25, 2025): > but the `libravatar` still using `md5` hash. [libravatar](https://github.com/strk/go-libravatar) is introduced by https://github.com/gogs/gogs/pull/3320 and maintained by @strk, do you have ideas about how to correct it?

GiteaMirror commented

2025-11-02 11:12:15 -06:00

@silverwind commented on GitHub (Apr 25, 2025):

Maybe it's time to incorporate that lib into gitea, it's only 300 lines of go code.

@silverwind commented on GitHub (Apr 25, 2025): Maybe it's time to incorporate that lib into gitea, it's only 300 lines of go code.

GiteaMirror commented

2025-11-02 11:12:16 -06:00

@becm commented on GitHub (Apr 27, 2025):

This would also be a good chance to also fix/improve Gitea's already existing avatar endpoints.

It has (maybe by accident) already a Gravatar-MD5-compatible notation for the default email-based avatar.
The content-derived checksum for user-supplied avatars is however incompatible with that location:

go-gitea/gitea#23041

Suggestion:

drop content-derived obfuscation and store avatar files with plain (unique internal) User-ID
add routing for respective SHA256 of emails
add routing for respective MD5/SHA1 values (optional compatibility layer)

This way, client tools with configurable avatar sources can get (user-assigned) avatars for commit listings.

@becm commented on GitHub (Apr 27, 2025): This would also be a good chance to also fix/improve Gitea's _already existing_ avatar endpoints. It has (maybe by accident) already a Gravatar-MD5-compatible notation for the default email-based avatar. The content-derived checksum for user-supplied avatars is however incompatible with that location: - go-gitea/gitea#23041 Suggestion: - drop content-derived obfuscation and store avatar files with plain (unique internal) User-ID - add routing for respective SHA256 of emails - add routing for respective MD5/SHA1 values (optional compatibility layer) This way, client tools with configurable avatar sources can get (user-assigned) avatars for commit listings.

GiteaMirror commented

2025-11-02 11:12:16 -06:00

@wxiaoguang commented on GitHub (Oct 11, 2025):

@go-gitea/maintainers and especially @strk

Since libravatar is unmaintained, and it's not clear whether any one is really using it, can we propose to remove "Federated Avatars" support in next release?

@wxiaoguang commented on GitHub (Oct 11, 2025): @go-gitea/maintainers and especially @strk Since `libravatar` is unmaintained, and it's not clear whether any one is really using it, can we propose to remove "Federated Avatars" support in next release?

GiteaMirror commented

2025-11-02 11:12:16 -06:00

@lunny commented on GitHub (Oct 11, 2025):

@go-gitea/maintainers and especially @strk

Since libravatar is unmaintained, and it's not clear whether any one is really using it, can we propose to remove "Federated Avatars" support in next release?

I agree we should replace or remove unmaintained library.

@lunny commented on GitHub (Oct 11, 2025): > [@go-gitea/maintainers](https://github.com/orgs/go-gitea/teams/maintainers) and especially [@strk](https://github.com/strk) > > Since `libravatar` is unmaintained, and it's not clear whether any one is really using it, can we propose to remove "Federated Avatars" support in next release? I agree we should replace or remove unmaintained library.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14410