Check GPG private key ownership before linking the public key to the profile #8553

New Issue

GiteaMirror · 2025-11-02T08:10:40-06:00

GiteaMirror commented

2025-11-02 08:10:40 -06:00

Originally created by @raboof on GitHub (Feb 12, 2022).

Feature Description

Currently, when I push a signed commit and attach the GPG public key to my profile, the commit shows a green lock linking to my user profile.

However, since I'm uploading the GPG public key, there is no guarantee that this GPG key is actually mine (i.e. that I own the corresponding private key).

It would be cool if gitea provided some way to prove that I actually own the private key associated with the public key I uploaded, and showed the difference when displaying a commit.

Originally created by @raboof on GitHub (Feb 12, 2022). ### Feature Description Currently, when I push a signed commit and attach the GPG public key to my profile, the commit shows a green lock linking to my user profile. However, since I'm uploading the GPG _public_ key, there is no guarantee that this GPG key is actually mine (i.e. that I own the corresponding private key). It would be cool if gitea provided some way to prove that I actually own the private key associated with the public key I uploaded, and showed the difference when displaying a commit.

GiteaMirror closed this issue

2025-11-02 08:10:40 -06:00

GiteaMirror commented

2025-11-02 08:10:41 -06:00

@zeripath commented on GitHub (Feb 12, 2022):

We only allow unverified keys to verify for an activated email address. Thus we know you own the email address. If you have added the public key and you own the email address we don't really need to verify if you have the private key or not. You've added it.

If you verify your key, you can use it verify any signature against any of your activated email addresses.

@zeripath commented on GitHub (Feb 12, 2022): We only allow unverified keys to verify for an activated email address. Thus we know you own the email address. If you have added the public key and you own the email address we don't really need to verify if you have the private key or not. You've added it. If you verify your key, you can use it verify any signature against any of your activated email addresses.

GiteaMirror commented

2025-11-02 08:10:41 -06:00

@raboof commented on GitHub (Feb 14, 2022):

We only allow unverified keys to verify for an activated email address

Aaah I didn't realize that

If you verify your key

.... and I missed that this is already possible. Awesome!

@raboof commented on GitHub (Feb 14, 2022): > We only allow unverified keys to verify for an activated email address Aaah I didn't realize that > If you verify your key .... and I missed that this is already possible. Awesome!

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#8553