SSH sign-only keys #9947

New Issue

GiteaMirror · 2025-11-02T08:53:52-06:00

GiteaMirror commented

2025-11-02 08:53:52 -06:00

Originally created by @jlbribeiro on GitHub (Dec 7, 2022).

Feature Description

Hello,
First of all, thank you to all Gitea contributors and maintainers for keeping Gitea amazing, long time user!

https://github.com/go-gitea/gitea/issues/17449, as implemented in https://github.com/go-gitea/gitea/pull/17743, brought commit signing using SSH keys to Gitea.

I was recently replicating my GitHub setup on a Gitea instance (running 1.18.0+rc0) and realized Gitea does not seem to support sign-only SSH keys (as GitHub does): the only way for SSH-signed commits to appear as verified is giving the signing SSH key full access to the user's repositories.

My feature request (improvement) is for Gitea to allow the distinction between access SSH keys and sign-only keys, so that both can be kept separate.

Once again, thank you for this wonderful open-source project.

Screenshots

Originally created by @jlbribeiro on GitHub (Dec 7, 2022). ### Feature Description Hello, First of all, thank you to all Gitea contributors and maintainers for keeping Gitea amazing, long time user! https://github.com/go-gitea/gitea/issues/17449, as implemented in https://github.com/go-gitea/gitea/pull/17743, brought commit signing using SSH keys to Gitea. I was recently replicating my GitHub setup on a Gitea instance (running `1.18.0+rc0`) and realized Gitea does not seem to support **sign-only** SSH keys (as [GitHub does](https://github.blog/changelog/2022-08-23-ssh-commit-verification-now-supported/)): the only way for SSH-signed commits to appear as verified is giving the signing SSH key full access to the user's repositories. My feature request (improvement) is for Gitea to allow the distinction between **access** SSH keys and **sign-only** keys, so that both can be kept separate. Once again, thank you for this wonderful open-source project. ### Screenshots ![GitHub's UI for sign-only SSH keys](https://i0.wp.com/user-images.githubusercontent.com/4021812/186039066-03b2d56f-6e15-44ee-a6ef-37bab5d5b47d.png?ssl=1)

GiteaMirror added the type/proposal type/feature labels 2025-11-02 08:53:52 -06:00

GiteaMirror commented

2025-11-02 08:53:53 -06:00

@tjmills-dev commented on GitHub (Nov 12, 2023):

This would be super useful - atm I have my github signing key without a passphrase, and then an access SSH key backed by a yubikey. I'd rather not have to press it each time when adding lots of commits, but equally don't want to decrease security by allowing an SSH key without a passphrase to authenticate.

@tjmills-dev commented on GitHub (Nov 12, 2023): This would be super useful - atm I have my github signing key without a passphrase, and then an access SSH key backed by a yubikey. I'd rather not have to press it each time when adding lots of commits, but equally don't want to decrease security by allowing an SSH key without a passphrase to authenticate.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9947