SSH key verification section in the web UI shows incorrect Windows commands #14954

New Issue

GiteaMirror · 2025-11-02T11:26:41-06:00

GiteaMirror commented

2025-11-02 11:26:41 -06:00

Originally created by @Leproide on GitHub (Sep 13, 2025).

Description

On Windows the key verification fails because an incorrect command is shown in the key upload section.
Same thing for pgp keys, but I can't solve it in this case.

Example below:

Wrong:
echo -n 'f3f9b8c0f7d4d52810a07f9f28df3e876d30079cdf67897996365fcf9ac0eec4' | ssh-keygen -Y sign -n gitea -f /path_to_PrivateKey_or_RelatedPublicKey

Correct:
echo f3f9b8c0f7d4d52810a07f9f28df3e876d30079cdf67897996365fcf9ac0eec4| ssh-keygen -Y sign -n gitea -f /path_to_PrivateKey_or_RelatedPublicKey

The problem appears to be that Windows treats the quotes and the trailing space before the pipe as part of the token. If you remove -n, the quotes and the space, the verification succeeds.

Screenshots

Gitea Version

1.24.5

Can you reproduce the bug on the Gitea demo site?

Yes

Operating System

Windows 10 22H2 (19045.6332)

Browser Version

Firefox 142.0.1 (64 bit

Originally created by @Leproide on GitHub (Sep 13, 2025). ### Description On Windows the key verification fails because an incorrect command is shown in the key upload section. Same thing for pgp keys, but I can't solve it in this case. Example below: Wrong: `echo -n 'f3f9b8c0f7d4d52810a07f9f28df3e876d30079cdf67897996365fcf9ac0eec4' | ssh-keygen -Y sign -n gitea -f /path_to_PrivateKey_or_RelatedPublicKey ` Correct: `echo f3f9b8c0f7d4d52810a07f9f28df3e876d30079cdf67897996365fcf9ac0eec4| ssh-keygen -Y sign -n gitea -f /path_to_PrivateKey_or_RelatedPublicKey` The problem appears to be that Windows treats the quotes and the trailing space before the pipe as part of the token. If you remove -n, the quotes and the space, the verification succeeds. ### Screenshots <img width="1054" height="310" alt="Image" src="https://github.com/user-attachments/assets/fe01c113-8fa1-4610-a69a-a64e4f44e567" /> ### Gitea Version 1.24.5 ### Can you reproduce the bug on the Gitea demo site? Yes ### Operating System Windows 10 22H2 (19045.6332) ### Browser Version Firefox 142.0.1 (64 bit

GiteaMirror added the type/bug topic/ui labels 2025-11-02 11:26:41 -06:00

GiteaMirror commented

2025-11-02 11:26:41 -06:00

@wxiaoguang commented on GitHub (Sep 13, 2025):

@wxiaoguang commented on GitHub (Sep 13, 2025): <img width="785" height="403" alt="Image" src="https://github.com/user-attachments/assets/3d657560-ec15-46f9-9e81-c9109aa23fef" />

GiteaMirror commented

2025-11-02 11:26:42 -06:00

@Leproide commented on GitHub (Sep 13, 2025):

Hi @wxiaoguang
With those commands you get the exact same error.
I tried them all and the only one that works without returning an error is the one I shared

Same problem on the PGP key:

But in this case nothing works

@Leproide commented on GitHub (Sep 13, 2025): Hi @wxiaoguang With those commands you get the exact same error. I tried them all and the only one that works without returning an error is the one I shared Same problem on the PGP key: <img width="990" height="194" alt="Image" src="https://github.com/user-attachments/assets/1c3c9248-9bb2-4252-a209-173c23aef663" /> But in this case nothing works <img width="1056" height="78" alt="Image" src="https://github.com/user-attachments/assets/c8885b4d-afa9-485f-94c2-991adf990005" />

GiteaMirror commented

2025-11-02 11:26:42 -06:00

@wxiaoguang commented on GitHub (Sep 13, 2025):

These commands are from Windows users: enhancement: add additional command hints for PowerShell & CMD (#33548)

Can you figure why they are wrong?

echo -n is for POSIX echo command, its prompt shouldn't be changed.

ps: I don't use Windows for development, so I have no idea about how to "fix" the prompts. Feel free to open a PR to fix the Windows commands if you got the correct commands.

@wxiaoguang commented on GitHub (Sep 13, 2025): These commands are from Windows users: enhancement: add additional command hints for PowerShell & CMD (#33548) Can you figure why they are wrong? `echo -n` is for POSIX echo command, its prompt shouldn't be changed. ---- ps: I don't use Windows for development, so I have no idea about how to "fix" the prompts. Feel free to open a PR to fix the Windows commands if you got the correct commands.

GiteaMirror commented

2025-11-02 11:26:42 -06:00

@Leproide commented on GitHub (Sep 13, 2025):

The correct command for the ssh key:

echo f3f9b8c0f7d4d52810a07f9f28df3e876d30079cdf67897996365fcf9ac0eec4| ssh-keygen -Y sign -n gitea -f /path_to_PrivateKey_or_RelatedPublicKey

No spaces, no quotes and works
Before making a pull request I would also like to understand how to solve the PGP verification

@Leproide commented on GitHub (Sep 13, 2025): The correct command for the ssh key: `echo f3f9b8c0f7d4d52810a07f9f28df3e876d30079cdf67897996365fcf9ac0eec4| ssh-keygen -Y sign -n gitea -f /path_to_PrivateKey_or_RelatedPublicKey` No spaces, no quotes and works Before making a pull request I would also like to understand how to solve the PGP verification

GiteaMirror commented

2025-11-02 11:26:42 -06:00

@Leproide commented on GitHub (Sep 13, 2025):

Ok, I figured out what happens with the PGP signature.
If on Windows you run, for example:

echo -n "42423d54c47e967870e0be184ed6d262dc7ce29e87fb1f0a628843e021504b85" > tmp.txt

You end up with a file containing:

-n "42423d54c47e967870e0be184ed6d262dc7ce29e87fb1f0a628843e021504b85"

which is basically what it tries to use as the token, and obviously that's wrong.

I solved it by creating a file, putting the correct token inside, and then running:

gpg --armor --default-key CORRECTKEYID --detach-sign tmp.txt

This will generate tmp.txt.asc.
Opening it with Notepad++ to fully respect the encoding, I copied the signature, and it was accepted.
The problem is Windows and how it handles strings in certain cases, next time I'll verify it by changing the value in the database; it'll be faster 😂

@Leproide commented on GitHub (Sep 13, 2025): Ok, I figured out what happens with the PGP signature. If on Windows you run, for example: ```bash echo -n "42423d54c47e967870e0be184ed6d262dc7ce29e87fb1f0a628843e021504b85" > tmp.txt ``` You end up with a file containing: ```bash -n "42423d54c47e967870e0be184ed6d262dc7ce29e87fb1f0a628843e021504b85" ``` which is basically what it tries to use as the token, and obviously that's wrong. I solved it by creating a file, putting the correct token inside, and then running: ```bash gpg --armor --default-key CORRECTKEYID --detach-sign tmp.txt ``` This will generate tmp.txt.asc. Opening it with Notepad++ to fully respect the encoding, I copied the signature, and it was accepted. The problem is Windows and how it handles strings in certain cases, next time I'll verify it by changing the value in the database; it'll be faster 😂

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14954