mirror of
https://github.com/go-gitea/gitea.git
synced 2026-03-11 17:46:29 -05:00
GPG not using correct UID #3257
Closed
opened 2025-11-02 05:05:38 -06:00 by GiteaMirror
·
14 comments
No Branch/Tag Specified
main
release/v1.25
release/v1.24
release/v1.23
release/v1.22
release/v1.21
release/v1.20
release/v1.19
release/v1.18
release/v1.17
release/v1.16
release/v1.15
release/v1.14
release/v1.13
release/v1.12
release/v1.11
release/v1.10
release/v1.9
release/v1.8
v1.25.3
v1.25.2
v1.25.1
v1.25.0
v1.24.7
v1.25.0-rc0
v1.26.0-dev
v1.24.6
v1.24.5
v1.24.4
v1.24.3
v1.24.2
v1.24.1
v1.24.0
v1.23.8
v1.24.0-rc0
v1.25.0-dev
v1.23.7
v1.23.6
v1.23.5
v1.23.4
v1.23.3
v1.23.2
v1.23.1
v1.23.0
v1.23.0-rc0
v1.24.0-dev
v1.22.6
v1.22.5
v1.22.4
v1.22.3
v1.22.2
v1.22.1
v1.22.0
v1.23.0-dev
v1.22.0-rc1
v1.21.11
v1.22.0-rc0
v1.21.10
v1.21.9
v1.21.8
v1.21.7
v1.21.6
v1.21.5
v1.21.4
v1.21.3
v1.21.2
v1.20.6
v1.21.1
v1.21.0
v1.21.0-rc2
v1.21.0-rc1
v1.20.5
v1.22.0-dev
v1.21.0-rc0
v1.20.4
v1.20.3
v1.20.2
v1.20.1
v1.20.0
v1.19.4
v1.21.0-dev
v1.20.0-rc2
v1.20.0-rc1
v1.20.0-rc0
v1.19.3
v1.19.2
v1.19.1
v1.19.0
v1.19.0-rc1
v1.20.0-dev
v1.19.0-rc0
v1.18.5
v1.18.4
v1.18.3
v1.18.2
v1.18.1
v1.18.0
v1.17.4
v1.18.0-rc1
v1.19.0-dev
v1.18.0-rc0
v1.17.3
v1.17.2
v1.17.1
v1.17.0
v1.17.0-rc2
v1.16.9
v1.17.0-rc1
v1.18.0-dev
v1.16.8
v1.16.7
v1.16.6
v1.16.5
v1.16.4
v1.16.3
v1.16.2
v1.16.1
v1.16.0
v1.15.11
v1.17.0-dev
v1.16.0-rc1
v1.15.10
v1.15.9
v1.15.8
v1.15.7
v1.15.6
v1.15.5
v1.15.4
v1.15.3
v1.15.2
v1.15.1
v1.14.7
v1.15.0
v1.15.0-rc3
v1.14.6
v1.15.0-rc2
v1.14.5
v1.16.0-dev
v1.15.0-rc1
v1.14.4
v1.14.3
v1.14.2
v1.14.1
v1.14.0
v1.13.7
v1.14.0-rc2
v1.13.6
v1.13.5
v1.14.0-rc1
v1.15.0-dev
v1.13.4
v1.13.3
v1.13.2
v1.13.1
v1.13.0
v1.12.6
v1.13.0-rc2
v1.14.0-dev
v1.13.0-rc1
v1.12.5
v1.12.4
v1.12.3
v1.12.2
v1.12.1
v1.11.8
v1.12.0
v1.11.7
v1.12.0-rc2
v1.11.6
v1.12.0-rc1
v1.13.0-dev
v1.11.5
v1.11.4
v1.11.3
v1.10.6
v1.12.0-dev
v1.11.2
v1.10.5
v1.11.1
v1.10.4
v1.11.0
v1.11.0-rc2
v1.10.3
v1.11.0-rc1
v1.10.2
v1.10.1
v1.10.0
v1.9.6
v1.9.5
v1.10.0-rc2
v1.11.0-dev
v1.10.0-rc1
v1.9.4
v1.9.3
v1.9.2
v1.9.1
v1.9.0
v1.9.0-rc2
v1.10.0-dev
v1.9.0-rc1
v1.8.3
v1.8.2
v1.8.1
v1.8.0
v1.8.0-rc3
v1.7.6
v1.8.0-rc2
v1.7.5
v1.8.0-rc1
v1.9.0-dev
v1.7.4
v1.7.3
v1.7.2
v1.7.1
v1.7.0
v1.7.0-rc3
v1.6.4
v1.7.0-rc2
v1.6.3
v1.7.0-rc1
v1.7.0-dev
v1.6.2
v1.6.1
v1.6.0
v1.6.0-rc2
v1.5.3
v1.6.0-rc1
v1.6.0-dev
v1.5.2
v1.5.1
v1.5.0
v1.5.0-rc2
v1.5.0-rc1
v1.5.0-dev
v1.4.3
v1.4.2
v1.4.1
v1.4.0
v1.4.0-rc3
v1.4.0-rc2
v1.3.3
v1.4.0-rc1
v1.3.2
v1.3.1
v1.3.0
v1.3.0-rc2
v1.3.0-rc1
v1.2.3
v1.2.2
v1.2.1
v1.2.0
v1.2.0-rc3
v1.2.0-rc2
v1.1.4
v1.2.0-rc1
v1.1.3
v1.1.2
v1.1.1
v1.1.0
v1.0.2
v1.0.1
v1.0.0
v0.9.99
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
Mirrored from GitHub Pull Request
No Label
type/bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/gitea#3257
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @crabctrl on GitHub (Apr 27, 2019).
[x]):Description
My GPG key has a revoked UID attached to it (it was revoked since I no longer own the email address it refers to). My primary UID is valid, and the email address it points to has been added to my Gitea account. However, when trying to add my key, Gitea displays the old (revoked) UID as the primary, and any commits signed using the updated key are marked as
No known key. I tried removing my old email address from my account, and now Gitea just says my I need to have my old address attached in order to load the key.It seem that Gitea is not correctly loading the primary UID. In addition, the commits should still be verified even with the updated key; it should be loading all UIDs ideally. Any help would be greatly appreciated.
@lafriks commented on GitHub (Apr 27, 2019):
Can you give your public gpg key that is problematic?
@crabctrl commented on GitHub (Apr 27, 2019):
My key fingerprint is
0E72F749E5D4E92F1F1D5F2BCDAD63AE9DA934BE, the actual key is:@sapk commented on GitHub (Apr 28, 2019):
Looking at your public key, the old UID is still the primary UID.It would need to check what identities is returned in from this keys where we search for matching emails.e83dddbd8c/models/gpg_key.go (L276)@sapk commented on GitHub (Apr 29, 2019):
I added a test to debug, and I seems to get both emails listed so it should match at least your new email. I need to look further to find the mismatch.
@sapk commented on GitHub (Apr 29, 2019):
Maybe we should update the lib:
2c2b8311ae (diff-e7ace1eeeac9cdf4f5fe331bf53e3fb2)@xf- commented on GitHub (Apr 30, 2019):
I use also multiple mail addresses in my key and commit with different once (work, private...).
@sapk you only look into loading issue of primary and not to load all UIDs or?
@sapk commented on GitHub (Apr 30, 2019):
@xf- We load all identities that are linked to the key. The problem here is that an identities is revoked in the key export and the lib we use still list it as a good identities. In fact if I recall well my testing, it doesn't even match/return the revocation.
@xf- commented on GitHub (Apr 30, 2019):
@sapk deleted the key and imported it again. Now it works! THX
@crabctrl commented on GitHub (May 5, 2019):
Is something still needed from me? (I only ask because of the label)
@sapk commented on GitHub (May 5, 2019):
@atoms118 No we have enough to reproduce (added as a test in #6794), To be fixed we would need to fix it in the lib we use that seems to list the identities of the revoked uid when it shouldn't (but doesn't list revoked uid for the key listed in there tests 😕). I haven't look futhermore.
@stale[bot] commented on GitHub (Jul 4, 2019):
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.
@sapk commented on GitHub (Jul 4, 2019):
This issue need to be kept open.
@zeripath commented on GitHub (Aug 13, 2020):
I am suspicious that this might have been resolved by #12155
@zeripath commented on GitHub (Aug 13, 2020):
OK I'm not certain completely what's going on here.
There's likely a part of this issue which has been resolved by #12155 (which affects subkey verifcation.)
Another part is likely fixed by @techknowlogick's recent PR removing the email address reporting on a commit - (so not necessarily fixed but masked).
Now there is the question about whether we should be verifying against a revoked identity, and #12486 stops that but... I think we need to double check against what GH does for revoked IDs. There's an issue with the way GH uses git signatures here - it uses them as committer verification and therefore a signature matching a revoked email address is not necessarily incorrect.
There is a final potential issue that I can see:
When you are posting your keys are you pasting multiple keys on a single keyring? Because Gitea isn't currently set up to do - it would be possible to cope with that but it's not doing that at present.