Read / Write deploy key not working #1626

New Issue

GiteaMirror · 2025-11-02T04:07:23-06:00

GiteaMirror commented

2025-11-02 04:07:23 -06:00

Originally created by @abueschel on GitHub (Mar 14, 2018).

Gitea version (or commit ref): a2a49c9 (from Docker image gitea/gitea)
Git version: 2.15.0
Operating system: Official docker image running on CentOS 7
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Mar 14 16:58:20 syslogd started: BusyBox v1.27.2
/etc/ssh/sshd_config line 32: Deprecated option UsePrivilegeSeparation
Mar 14 15:58:20 sshd[15]: Server listening on :: port 22.
Mar 14 15:58:20 sshd[15]: Server listening on 0.0.0.0 port 22.
2018/03/14 16:58:20 [T] AppPath: /app/gitea/gitea
2018/03/14 16:58:20 [T] AppWorkPath: /app/gitea
2018/03/14 16:58:20 [T] Custom path: /data/gitea
2018/03/14 16:58:20 [T] Log path: /data/gitea/log
2018/03/14 16:58:20 Serving [::]:3000 with pid 14
[...]
Mar 14 15:59:15 sshd[56]: rexec line 32: Deprecated option UsePrivilegeSeparation
Mar 14 15:59:15 sshd[56]: Accepted publickey for git from 172.19.0.1 port 34068 ssh2: RSA SHA256:[...]
Mar 14 15:59:15 sshd[58]: Received disconnect from 172.19.0.1 port 34068:11: disconnected by user
Mar 14 15:59:15 sshd[58]: Disconnected from user git 172.19.0.1 port 34068

Description

If i add a deploy key to one of my repositories without enabling "Allow write access" I can clone/pull. If I add the exact same key to the repo with Read / Write access, i get an error:

git clone ssh://git@git.xxx.de:2222/user/repo.git
Cloning into 'repo'...
Gitea: Key access denied
Deploy key access denied: [key_id: 2, repo_id: 10]
fatal: Could not read from remote repository.

I also could reproduce the issue with the newest 1.4 Docker image.

I hope this is all the relevant information but I can provide more if needed.

Originally created by @abueschel on GitHub (Mar 14, 2018). - Gitea version (or commit ref): a2a49c9 (from Docker image gitea/gitea) - Git version: 2.15.0 - Operating system: Official docker image running on CentOS 7 - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: ``` Mar 14 16:58:20 syslogd started: BusyBox v1.27.2 /etc/ssh/sshd_config line 32: Deprecated option UsePrivilegeSeparation Mar 14 15:58:20 sshd[15]: Server listening on :: port 22. Mar 14 15:58:20 sshd[15]: Server listening on 0.0.0.0 port 22. 2018/03/14 16:58:20 [T] AppPath: /app/gitea/gitea 2018/03/14 16:58:20 [T] AppWorkPath: /app/gitea 2018/03/14 16:58:20 [T] Custom path: /data/gitea 2018/03/14 16:58:20 [T] Log path: /data/gitea/log 2018/03/14 16:58:20 Serving [::]:3000 with pid 14 [...] Mar 14 15:59:15 sshd[56]: rexec line 32: Deprecated option UsePrivilegeSeparation Mar 14 15:59:15 sshd[56]: Accepted publickey for git from 172.19.0.1 port 34068 ssh2: RSA SHA256:[...] Mar 14 15:59:15 sshd[58]: Received disconnect from 172.19.0.1 port 34068:11: disconnected by user Mar 14 15:59:15 sshd[58]: Disconnected from user git 172.19.0.1 port 34068 ``` ## Description If i add a deploy key to one of my repositories without enabling "Allow write access" I can clone/pull. If I add the exact same key to the repo with Read / Write access, i get an error: ``` git clone ssh://git@git.xxx.de:2222/user/repo.git Cloning into 'repo'... Gitea: Key access denied Deploy key access denied: [key_id: 2, repo_id: 10] fatal: Could not read from remote repository. ``` I also could reproduce the issue with the newest 1.4 Docker image. I hope this is all the relevant information but I can provide more if needed.

GiteaMirror added the issue/stale type/bug labels 2025-11-02 04:07:23 -06:00

GiteaMirror closed this issue

2025-11-02 04:07:23 -06:00

GiteaMirror commented

2025-11-02 04:07:24 -06:00

@techknowlogick commented on GitHub (Mar 17, 2018):

In the admin panel have you tried running the Rewrite '.ssh/authorized_keys' file (for Gitea SSH keys). operation?

@techknowlogick commented on GitHub (Mar 17, 2018): In the admin panel have you tried running the `Rewrite '.ssh/authorized_keys' file (for Gitea SSH keys).` operation?

GiteaMirror commented

2025-11-02 04:07:24 -06:00

@abueschel commented on GitHub (Mar 19, 2018):

Yes I tried that with no success. I also updated the Image to c28bf94 and ran it again today, the error still persists.

@abueschel commented on GitHub (Mar 19, 2018): Yes I tried that with no success. I also updated the Image to c28bf94 and ran it again today, the error still persists.

GiteaMirror commented

2025-11-02 04:07:24 -06:00

@manuelmohr commented on GitHub (Mar 27, 2018):

I have the exact same problem. Rewriting authorized_keys did not help either.

@manuelmohr commented on GitHub (Mar 27, 2018): I have the exact same problem. Rewriting `authorized_keys` did not help either.

GiteaMirror commented

2025-11-02 04:07:25 -06:00

@sphrak commented on GitHub (Jun 30, 2018):

Can confirm this issue still persists on 1.4.3. To clarify what breaks is the write mode -- not read mode, that works. Rewriting the authorized_keys does not change anything it still doesnt work.

@sphrak commented on GitHub (Jun 30, 2018): Can confirm this issue still persists on `1.4.3`. To clarify what breaks is the write mode -- not read mode, that works. Rewriting the `authorized_keys` does not change anything it still doesnt work.

GiteaMirror commented

2025-11-02 04:07:25 -06:00

@MarAvFe commented on GitHub (Sep 9, 2018):

I had the same issue yesterday. I was running gitlab and migrated all repos to gitea. After all the config, ssh keys wouldn't work. Rewriting the ssh file wouldn't work. But I had to add a new config to workingDirectory/custom/conf/app.ini:

; https://github.com/go-gitea/gitea/blob/master/custom/conf/app.ini.sample#L153
[server]
; Root path of SSH directory, default is '~/.ssh', but you have to use '/home/git/.ssh'.
SSH_ROOT_PATH = /var/opt/gitlab/.ssh

Of course, the value is dependent of your server config. After that, I added the key to my user, and it didn't work.

But I tried the Rewrite '.ssh/authorized_keys' file (for Gitea SSH keys). operation and it worked.

This is on Gitea v1.5.1

@MarAvFe commented on GitHub (Sep 9, 2018): I had the same issue yesterday. I was running gitlab and migrated all repos to gitea. After all the config, ssh keys wouldn't work. Rewriting the ssh file wouldn't work. But I had to add a new config to `workingDirectory/custom/conf/app.ini`: ```ini ; https://github.com/go-gitea/gitea/blob/master/custom/conf/app.ini.sample#L153 [server] ; Root path of SSH directory, default is '~/.ssh', but you have to use '/home/git/.ssh'. SSH_ROOT_PATH = /var/opt/gitlab/.ssh ``` Of course, the value is dependent of your server config. After that, I added the key to my user, and it didn't work. But I tried the `Rewrite '.ssh/authorized_keys' file (for Gitea SSH keys).` operation and it worked. This is on Gitea v1.5.1

GiteaMirror commented

2025-11-02 04:07:25 -06:00

@westhom commented on GitHub (Nov 16, 2018):

Also ran into the issue on 1.5.3. I added a read-only deploy key but I got the error when cloning:

Gitea: Invalid key ID
Invalid key ID[key-6]: public key does not exist [id: 6]

Running the rewrite authorized_keys command from the dashboard fixed the issue.

@westhom commented on GitHub (Nov 16, 2018): Also ran into the issue on 1.5.3. I added a read-only deploy key but I got the error when cloning: ``` Gitea: Invalid key ID Invalid key ID[key-6]: public key does not exist [id: 6] ``` Running the rewrite authorized_keys command from the dashboard fixed the issue.

GiteaMirror commented

2025-11-02 04:07:25 -06:00

@pew commented on GitHub (Nov 20, 2018):

I have this issue as well with gitea 1.5.3, setting the SSH_ROOT_PATH and rewriting the keys didn't work.

Gitea: Key access denied
Deploy key access denied: [key_id: 16, repo_id: 56]
fatal: Could not read from remote repository.

However, when giving the deploy key also write access it works. Which is something I don't want though.

@pew commented on GitHub (Nov 20, 2018): I have this issue as well with gitea 1.5.3, setting the `SSH_ROOT_PATH` and rewriting the keys didn't work. ``` Gitea: Key access denied Deploy key access denied: [key_id: 16, repo_id: 56] fatal: Could not read from remote repository. ``` However, when giving the deploy key also **write** access it works. Which is something I don't want though.

GiteaMirror commented

2025-11-02 04:07:26 -06:00

@lunny commented on GitHub (Jan 9, 2019):

I think this should be a design error on public_key table. We have to keep Fingerprint unique so that there is no duplicated public key on the authorized_keys file.

@lunny commented on GitHub (Jan 9, 2019): I think this should be a design error on `public_key` table. We have to keep `Fingerprint` unique so that there is no duplicated public key on the authorized_keys file.

GiteaMirror commented

2025-11-02 04:07:26 -06:00

@lunny commented on GitHub (Jan 9, 2019):

I will try to send a PR to fix that and migrate old data to new struct.

@lunny commented on GitHub (Jan 9, 2019): I will try to send a PR to fix that and migrate old data to new struct.

GiteaMirror commented

2025-11-02 04:07:26 -06:00

@stale[bot] commented on GitHub (Mar 10, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Mar 10, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

GiteaMirror commented

2025-11-02 04:07:26 -06:00

@zeripath commented on GitHub (Mar 10, 2019):

Fixed by #5939

@zeripath commented on GitHub (Mar 10, 2019): Fixed by #5939

GiteaMirror referenced this issue

2025-11-02 11:58:59 -06:00

[PR #1628] [MERGED] Handle display of GPG key without end date #15959

Sign in to join this conversation.