feat(sec): Add SSH signing support for instances (#6897)

- Add support to set `gpg.format` in the Git config, via the new `[repository.signing].FORMAT` option. This is to tell Git that the instance would like to use SSH instead of OpenPGP to sign its commits. This is guarded behind a Git version check for v2.34.0 and a check that a `ssh-keygen` binary is present.
- Add support to recognize the public SSH key that is given to `[repository.signing].SIGNING_KEY` as the signing key by the instance.
- Thus this allows the instance to use SSH commit signing for commits that the instance creates (e.g. initial and squash commits) instead of using PGP.
- Technically (although I have no clue how as this is not documented) you can have a different PGP signing key for different repositories; this is not implemented for SSH signing.
- Add unit and integration testing.
  - `TestInstanceSigning` was reworked from `TestGPGGit`, now also includes testing for SHA256 repositories. Is the main integration test that actually signs commits and checks that they are marked as verified by Forgejo.
  - `TestParseCommitWithSSHSignature` is a unit test that makes sure that if a SSH instnace signing key is set, that it is used to possibly verify instance SSH signed commits.
  - `TestSyncConfigGPGFormat` is a unit test that makes sure the correct git config is set according to the signing format setting. Also checks that the guarded git version check and ssh-keygen binary presence check is done correctly.
  - `TestSSHInstanceKey` is a unit test that makes sure the parsing of a SSH signing key is done correctly.
  - `TestAPISSHSigningKey` is a integration test that makes sure the newly added API route `/api/v1/signing-key.ssh` responds correctly.

Documentation PR: forgejo/docs#1122

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6897
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
This commit is contained in:
Gusted 2025-04-11 13:25:35 +00:00 committed by Gusted
parent eb85681b41
commit b55c72828e
17 changed files with 687 additions and 306 deletions

View file

@ -11,8 +11,10 @@ import (
"testing"
"forgejo.org/modules/setting"
"forgejo.org/modules/test"
"forgejo.org/modules/util"
"github.com/hashicorp/go-version"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
@ -94,3 +96,57 @@ func TestSyncConfig(t *testing.T) {
assert.True(t, gitConfigContains("[sync-test]"))
assert.True(t, gitConfigContains("cfg-key-a = CfgValA"))
}
func TestSyncConfigGPGFormat(t *testing.T) {
defer test.MockProtect(&setting.GitConfig)()
t.Run("No format", func(t *testing.T) {
defer test.MockVariableValue(&setting.Repository.Signing.Format, "")()
require.NoError(t, syncGitConfig())
assert.True(t, gitConfigContains("[gpg]"))
assert.True(t, gitConfigContains("format = openpgp"))
})
t.Run("SSH format", func(t *testing.T) {
r, err := os.OpenRoot(t.TempDir())
require.NoError(t, err)
f, err := r.OpenFile("ssh-keygen", os.O_CREATE|os.O_TRUNC, 0o700)
require.NoError(t, f.Close())
require.NoError(t, err)
t.Setenv("PATH", r.Name())
defer test.MockVariableValue(&setting.Repository.Signing.Format, "ssh")()
require.NoError(t, syncGitConfig())
assert.True(t, gitConfigContains("[gpg]"))
assert.True(t, gitConfigContains("format = ssh"))
t.Run("Old version", func(t *testing.T) {
oldVersion, err := version.NewVersion("2.33.0")
require.NoError(t, err)
defer test.MockVariableValue(&gitVersion, oldVersion)()
require.ErrorContains(t, syncGitConfig(), "ssh signing requires Git >= 2.34.0")
})
t.Run("No ssh-keygen binary", func(t *testing.T) {
require.NoError(t, r.Remove("ssh-keygen"))
require.ErrorContains(t, syncGitConfig(), "git signing requires a ssh-keygen binary")
})
t.Run("Dynamic ssh-keygen binary location", func(t *testing.T) {
f, err := r.OpenFile("ssh-keygen-2", os.O_CREATE|os.O_TRUNC, 0o700)
require.NoError(t, f.Close())
require.NoError(t, err)
defer test.MockVariableValue(&setting.GitConfig.Options, map[string]string{
"gpg.ssh.program": "ssh-keygen-2",
})()
require.NoError(t, syncGitConfig())
})
})
t.Run("OpenPGP format", func(t *testing.T) {
defer test.MockVariableValue(&setting.Repository.Signing.Format, "openpgp")()
require.NoError(t, syncGitConfig())
assert.True(t, gitConfigContains("[gpg]"))
assert.True(t, gitConfigContains("format = openpgp"))
})
}