PGP-signed commits shows user email, not signing-key email #5849

New Issue

GiteaMirror · 2025-11-02T06:38:12-06:00

GiteaMirror commented

2025-11-02 06:38:12 -06:00

Originally created by @ninewise on GitHub (Aug 11, 2020).

Gitea version (or commit ref): v1.12.2
Git version: 2.26.2
Operating system: Alpine Linux
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite

Description

Creating this issue for a friend without github.

This line populates the verification reason with the email associated with the signer parameter and not the email received in the last parameter. signer gets populated with the Gitea user information in hashAndVerifyForKeyID here, while email is the one associated with the key. This makes the UI show counter-intuitive information: if I registered with gitea@example.com and my signing key is associated with pgp@example.com, UI will show that it was signed by gitea@example.com / KEYID instead of pgp@xample.com / KEYID. Even worse, UI will show that even when you choose to hide your email address.

Originally created by @ninewise on GitHub (Aug 11, 2020). - Gitea version (or commit ref): v1.12.2 - Git version: 2.26.2 - Operating system: Alpine Linux - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite ## Description Creating this issue for a friend without github. [This line] populates the verification reason with the email associated with the `signer` parameter and not the `email` received in the last parameter. `signer` gets populated with the Gitea user information in `hashAndVerifyForKeyID` [here], while `email` is the one associated with the key. This makes the UI show counter-intuitive information: if I registered with `gitea@example.com` and my signing key is associated with `pgp@example.com`, UI will show that it was signed by `gitea@example.com / KEYID` instead of `pgp@xample.com / KEYID`. Even worse, UI will show that even when you choose to hide your email address. [This line]: https://github.com/go-gitea/gitea/blob/8a0bb7cd040b17e6c6c3d75b4b76051953253c31/models/gpg_key.go#L454 [here]: https://github.com/go-gitea/gitea/blob/8a0bb7cd040b17e6c6c3d75b4b76051953253c31/models/gpg_key.go#L579

GiteaMirror closed this issue

2025-11-02 06:38:13 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#5849