mirror of
				https://codeberg.org/forgejo/forgejo.git
				synced 2025-10-25 03:22:36 +00:00 
			
		
		
		
	* Add support for ssh commit signing * Split out ssh verification to separate file * Show ssh key fingerprint on commit page * Update sshsig lib * Make sure we verify against correct namespace * Add ssh public key verification via ssh signatures When adding a public ssh key also validate that this user actually owns the key by signing a token with the private key. * Remove some gpg references and make verify key optional * Fix spaces indentation * Update options/locale/locale_en-US.ini Co-authored-by: Gusted <williamzijl7@hotmail.com> * Update templates/user/settings/keys_ssh.tmpl Co-authored-by: Gusted <williamzijl7@hotmail.com> * Update options/locale/locale_en-US.ini Co-authored-by: Gusted <williamzijl7@hotmail.com> * Update options/locale/locale_en-US.ini Co-authored-by: Gusted <williamzijl7@hotmail.com> * Update models/ssh_key_commit_verification.go Co-authored-by: Gusted <williamzijl7@hotmail.com> * Reword ssh/gpg_key_success message * Change Badsignature to NoKeyFound * Add sign/verify tests * Fix upstream api changes to user_model User * Match exact on SSH signature * Fix code review remarks Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
		
			
				
	
	
		
			264 lines
		
	
	
	
		
			7.4 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
			
		
		
	
	
			264 lines
		
	
	
	
		
			7.4 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
| // Copyright 2021 The Gitea Authors. All rights reserved.
 | |
| // Use of this source code is governed by a MIT-style
 | |
| // license that can be found in the LICENSE file.
 | |
| 
 | |
| package asymkey
 | |
| 
 | |
| import "fmt"
 | |
| 
 | |
| // ErrKeyUnableVerify represents a "KeyUnableVerify" kind of error.
 | |
| type ErrKeyUnableVerify struct {
 | |
| 	Result string
 | |
| }
 | |
| 
 | |
| // IsErrKeyUnableVerify checks if an error is a ErrKeyUnableVerify.
 | |
| func IsErrKeyUnableVerify(err error) bool {
 | |
| 	_, ok := err.(ErrKeyUnableVerify)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrKeyUnableVerify) Error() string {
 | |
| 	return fmt.Sprintf("Unable to verify key content [result: %s]", err.Result)
 | |
| }
 | |
| 
 | |
| // ErrKeyNotExist represents a "KeyNotExist" kind of error.
 | |
| type ErrKeyNotExist struct {
 | |
| 	ID int64
 | |
| }
 | |
| 
 | |
| // IsErrKeyNotExist checks if an error is a ErrKeyNotExist.
 | |
| func IsErrKeyNotExist(err error) bool {
 | |
| 	_, ok := err.(ErrKeyNotExist)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrKeyNotExist) Error() string {
 | |
| 	return fmt.Sprintf("public key does not exist [id: %d]", err.ID)
 | |
| }
 | |
| 
 | |
| // ErrKeyAlreadyExist represents a "KeyAlreadyExist" kind of error.
 | |
| type ErrKeyAlreadyExist struct {
 | |
| 	OwnerID     int64
 | |
| 	Fingerprint string
 | |
| 	Content     string
 | |
| }
 | |
| 
 | |
| // IsErrKeyAlreadyExist checks if an error is a ErrKeyAlreadyExist.
 | |
| func IsErrKeyAlreadyExist(err error) bool {
 | |
| 	_, ok := err.(ErrKeyAlreadyExist)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrKeyAlreadyExist) Error() string {
 | |
| 	return fmt.Sprintf("public key already exists [owner_id: %d, finger_print: %s, content: %s]",
 | |
| 		err.OwnerID, err.Fingerprint, err.Content)
 | |
| }
 | |
| 
 | |
| // ErrKeyNameAlreadyUsed represents a "KeyNameAlreadyUsed" kind of error.
 | |
| type ErrKeyNameAlreadyUsed struct {
 | |
| 	OwnerID int64
 | |
| 	Name    string
 | |
| }
 | |
| 
 | |
| // IsErrKeyNameAlreadyUsed checks if an error is a ErrKeyNameAlreadyUsed.
 | |
| func IsErrKeyNameAlreadyUsed(err error) bool {
 | |
| 	_, ok := err.(ErrKeyNameAlreadyUsed)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrKeyNameAlreadyUsed) Error() string {
 | |
| 	return fmt.Sprintf("public key already exists [owner_id: %d, name: %s]", err.OwnerID, err.Name)
 | |
| }
 | |
| 
 | |
| // ErrGPGNoEmailFound represents a "ErrGPGNoEmailFound" kind of error.
 | |
| type ErrGPGNoEmailFound struct {
 | |
| 	FailedEmails []string
 | |
| 	ID           string
 | |
| }
 | |
| 
 | |
| // IsErrGPGNoEmailFound checks if an error is a ErrGPGNoEmailFound.
 | |
| func IsErrGPGNoEmailFound(err error) bool {
 | |
| 	_, ok := err.(ErrGPGNoEmailFound)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrGPGNoEmailFound) Error() string {
 | |
| 	return fmt.Sprintf("none of the emails attached to the GPG key could be found: %v", err.FailedEmails)
 | |
| }
 | |
| 
 | |
| // ErrGPGInvalidTokenSignature represents a "ErrGPGInvalidTokenSignature" kind of error.
 | |
| type ErrGPGInvalidTokenSignature struct {
 | |
| 	Wrapped error
 | |
| 	ID      string
 | |
| }
 | |
| 
 | |
| // IsErrGPGInvalidTokenSignature checks if an error is a ErrGPGInvalidTokenSignature.
 | |
| func IsErrGPGInvalidTokenSignature(err error) bool {
 | |
| 	_, ok := err.(ErrGPGInvalidTokenSignature)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrGPGInvalidTokenSignature) Error() string {
 | |
| 	return "the provided signature does not sign the token with the provided key"
 | |
| }
 | |
| 
 | |
| // ErrGPGKeyParsing represents a "ErrGPGKeyParsing" kind of error.
 | |
| type ErrGPGKeyParsing struct {
 | |
| 	ParseError error
 | |
| }
 | |
| 
 | |
| // IsErrGPGKeyParsing checks if an error is a ErrGPGKeyParsing.
 | |
| func IsErrGPGKeyParsing(err error) bool {
 | |
| 	_, ok := err.(ErrGPGKeyParsing)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrGPGKeyParsing) Error() string {
 | |
| 	return fmt.Sprintf("failed to parse gpg key %s", err.ParseError.Error())
 | |
| }
 | |
| 
 | |
| // ErrGPGKeyNotExist represents a "GPGKeyNotExist" kind of error.
 | |
| type ErrGPGKeyNotExist struct {
 | |
| 	ID int64
 | |
| }
 | |
| 
 | |
| // IsErrGPGKeyNotExist checks if an error is a ErrGPGKeyNotExist.
 | |
| func IsErrGPGKeyNotExist(err error) bool {
 | |
| 	_, ok := err.(ErrGPGKeyNotExist)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrGPGKeyNotExist) Error() string {
 | |
| 	return fmt.Sprintf("public gpg key does not exist [id: %d]", err.ID)
 | |
| }
 | |
| 
 | |
| // ErrGPGKeyImportNotExist represents a "GPGKeyImportNotExist" kind of error.
 | |
| type ErrGPGKeyImportNotExist struct {
 | |
| 	ID string
 | |
| }
 | |
| 
 | |
| // IsErrGPGKeyImportNotExist checks if an error is a ErrGPGKeyImportNotExist.
 | |
| func IsErrGPGKeyImportNotExist(err error) bool {
 | |
| 	_, ok := err.(ErrGPGKeyImportNotExist)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrGPGKeyImportNotExist) Error() string {
 | |
| 	return fmt.Sprintf("public gpg key import does not exist [id: %s]", err.ID)
 | |
| }
 | |
| 
 | |
| // ErrGPGKeyIDAlreadyUsed represents a "GPGKeyIDAlreadyUsed" kind of error.
 | |
| type ErrGPGKeyIDAlreadyUsed struct {
 | |
| 	KeyID string
 | |
| }
 | |
| 
 | |
| // IsErrGPGKeyIDAlreadyUsed checks if an error is a ErrKeyNameAlreadyUsed.
 | |
| func IsErrGPGKeyIDAlreadyUsed(err error) bool {
 | |
| 	_, ok := err.(ErrGPGKeyIDAlreadyUsed)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrGPGKeyIDAlreadyUsed) Error() string {
 | |
| 	return fmt.Sprintf("public key already exists [key_id: %s]", err.KeyID)
 | |
| }
 | |
| 
 | |
| // ErrGPGKeyAccessDenied represents a "GPGKeyAccessDenied" kind of Error.
 | |
| type ErrGPGKeyAccessDenied struct {
 | |
| 	UserID int64
 | |
| 	KeyID  int64
 | |
| }
 | |
| 
 | |
| // IsErrGPGKeyAccessDenied checks if an error is a ErrGPGKeyAccessDenied.
 | |
| func IsErrGPGKeyAccessDenied(err error) bool {
 | |
| 	_, ok := err.(ErrGPGKeyAccessDenied)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| // Error pretty-prints an error of type ErrGPGKeyAccessDenied.
 | |
| func (err ErrGPGKeyAccessDenied) Error() string {
 | |
| 	return fmt.Sprintf("user does not have access to the key [user_id: %d, key_id: %d]",
 | |
| 		err.UserID, err.KeyID)
 | |
| }
 | |
| 
 | |
| // ErrKeyAccessDenied represents a "KeyAccessDenied" kind of error.
 | |
| type ErrKeyAccessDenied struct {
 | |
| 	UserID int64
 | |
| 	KeyID  int64
 | |
| 	Note   string
 | |
| }
 | |
| 
 | |
| // IsErrKeyAccessDenied checks if an error is a ErrKeyAccessDenied.
 | |
| func IsErrKeyAccessDenied(err error) bool {
 | |
| 	_, ok := err.(ErrKeyAccessDenied)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrKeyAccessDenied) Error() string {
 | |
| 	return fmt.Sprintf("user does not have access to the key [user_id: %d, key_id: %d, note: %s]",
 | |
| 		err.UserID, err.KeyID, err.Note)
 | |
| }
 | |
| 
 | |
| // ErrDeployKeyNotExist represents a "DeployKeyNotExist" kind of error.
 | |
| type ErrDeployKeyNotExist struct {
 | |
| 	ID     int64
 | |
| 	KeyID  int64
 | |
| 	RepoID int64
 | |
| }
 | |
| 
 | |
| // IsErrDeployKeyNotExist checks if an error is a ErrDeployKeyNotExist.
 | |
| func IsErrDeployKeyNotExist(err error) bool {
 | |
| 	_, ok := err.(ErrDeployKeyNotExist)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrDeployKeyNotExist) Error() string {
 | |
| 	return fmt.Sprintf("Deploy key does not exist [id: %d, key_id: %d, repo_id: %d]", err.ID, err.KeyID, err.RepoID)
 | |
| }
 | |
| 
 | |
| // ErrDeployKeyAlreadyExist represents a "DeployKeyAlreadyExist" kind of error.
 | |
| type ErrDeployKeyAlreadyExist struct {
 | |
| 	KeyID  int64
 | |
| 	RepoID int64
 | |
| }
 | |
| 
 | |
| // IsErrDeployKeyAlreadyExist checks if an error is a ErrDeployKeyAlreadyExist.
 | |
| func IsErrDeployKeyAlreadyExist(err error) bool {
 | |
| 	_, ok := err.(ErrDeployKeyAlreadyExist)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrDeployKeyAlreadyExist) Error() string {
 | |
| 	return fmt.Sprintf("public key already exists [key_id: %d, repo_id: %d]", err.KeyID, err.RepoID)
 | |
| }
 | |
| 
 | |
| // ErrDeployKeyNameAlreadyUsed represents a "DeployKeyNameAlreadyUsed" kind of error.
 | |
| type ErrDeployKeyNameAlreadyUsed struct {
 | |
| 	RepoID int64
 | |
| 	Name   string
 | |
| }
 | |
| 
 | |
| // IsErrDeployKeyNameAlreadyUsed checks if an error is a ErrDeployKeyNameAlreadyUsed.
 | |
| func IsErrDeployKeyNameAlreadyUsed(err error) bool {
 | |
| 	_, ok := err.(ErrDeployKeyNameAlreadyUsed)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrDeployKeyNameAlreadyUsed) Error() string {
 | |
| 	return fmt.Sprintf("public key with name already exists [repo_id: %d, name: %s]", err.RepoID, err.Name)
 | |
| }
 | |
| 
 | |
| // ErrSSHInvalidTokenSignature represents a "ErrSSHInvalidTokenSignature" kind of error.
 | |
| type ErrSSHInvalidTokenSignature struct {
 | |
| 	Wrapped     error
 | |
| 	Fingerprint string
 | |
| }
 | |
| 
 | |
| // IsErrSSHInvalidTokenSignature checks if an error is a ErrSSHInvalidTokenSignature.
 | |
| func IsErrSSHInvalidTokenSignature(err error) bool {
 | |
| 	_, ok := err.(ErrSSHInvalidTokenSignature)
 | |
| 	return ok
 | |
| }
 | |
| 
 | |
| func (err ErrSSHInvalidTokenSignature) Error() string {
 | |
| 	return "the provided signature does not sign the token with the provided key"
 | |
| }
 |