Signing with server gpg key but with committer's name and email #6898

New Issue

GiteaMirror · 2025-11-02T07:10:34-06:00

GiteaMirror commented

2025-11-02 07:10:34 -06:00

Originally created by @lunny on GitHub (Feb 18, 2021).

Currently, we will signature the commit with name and email which configured on app.ini. But another option is signature with committer's name and email. I think that's what Github did.

If we can have a configuration item to let user chose that, it's better.

Originally created by @lunny on GitHub (Feb 18, 2021). Currently, we will signature the commit with name and email which configured on app.ini. But another option is signature with committer's name and email. I think that's what Github did. If we can have a configuration item to let user chose that, it's better.

GiteaMirror added the type/proposal topic/commit-signing labels 2025-11-02 07:10:34 -06:00

GiteaMirror commented

2025-11-02 07:10:34 -06:00

@zeripath commented on GitHub (Feb 28, 2021):

We already have that option.

Trustmodels #11712

@zeripath commented on GitHub (Feb 28, 2021): We already have that option. Trustmodels #11712

GiteaMirror commented

2025-11-02 07:10:35 -06:00

@zeripath commented on GitHub (Feb 28, 2021):

DEFAULT_TRUST_MODEL: collaborator: [collaborator, committer, collaboratorcommitter]: The default trust model used for verifying commits.

collaborator: Trust signatures signed by keys of collaborators.
committer: Trust signatures that match committers (This matches GitHub and will force Gitea signed commits to have Gitea as the commmitter).
collaboratorcommitter: Trust signatures signed by keys of collaborators which match the commiter.

@zeripath commented on GitHub (Feb 28, 2021): DEFAULT_TRUST_MODEL: collaborator: [collaborator, committer, collaboratorcommitter]: The default trust model used for verifying commits. * collaborator: Trust signatures signed by keys of collaborators. * committer: Trust signatures that match committers (This matches GitHub and will force Gitea signed commits to have Gitea as the commmitter). * collaboratorcommitter: Trust signatures signed by keys of collaborators which match the commiter.

GiteaMirror commented

2025-11-02 07:10:35 -06:00

@lunny commented on GitHub (Mar 4, 2021):

But it always displayed configured user name and email but not the doer on the UI?

@lunny commented on GitHub (Mar 4, 2021): But it always displayed configured user name and email but not the doer on the UI?

GiteaMirror commented

2025-11-02 07:10:35 -06:00

@zeripath commented on GitHub (Mar 4, 2021):

I don't understand.

In the committer model the for signed commits done by gitea the committer would have to be gitea itself - with a trailer added to the message to state who gitea was committing for. (GitHub doesn't add that trailer and so commits by GitHub actually lose the committer information.)

Gitea currently defaults to the collaborator trust model so unless you've actually changed the model you won't have seen this.

It's worth noting that gpg commits signed by gitea in the collaborator model are not trusted in the committer model so changing model is a potential problem requiring re-signing and committing.

Gitea still doesn't have support for parsing trailer co-authors but it wouldn't be so hard to add it. If we added co-commiter support we'd have a step up from here.

@zeripath commented on GitHub (Mar 4, 2021): I don't understand. In the committer model the for signed commits done by gitea the committer would have to be gitea itself - with a trailer added to the message to state who gitea was committing for. (GitHub doesn't add that trailer and so commits by GitHub actually lose the committer information.) Gitea currently defaults to the collaborator trust model so unless you've actually changed the model you won't have seen this. It's worth noting that gpg commits signed by gitea in the collaborator model are not trusted in the committer model so changing model is a potential problem requiring re-signing and committing. --- Gitea still doesn't have support for parsing trailer co-authors but it wouldn't be so hard to add it. If we added co-commiter support we'd have a step up from here.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#6898