This PR fixes#7598 by providing a configurable way of signing commits across the Gitea instance. Per repository configurability and import/generation of trusted secure keys is not provided by this PR - from a security PoV that's probably impossible to do properly. Similarly web-signing, that is asking the user to sign something, is not implemented - this could be done at a later stage however.
## Features
- [x] If commit.gpgsign is set in .gitconfig sign commits and files created through repofiles. (merges should already have been signed.)
- [x] Verify commits signed with the default gpg as valid
- [x] Signer, Committer and Author can all be different
- [x] Allow signer to be arbitrarily different - We still require the key to have an activated email on Gitea. A more complete implementation would be to use a keyserver and mark external-or-unactivated with an "unknown" trust level icon.
- [x] Add a signing-key.gpg endpoint to get the default gpg pub key if available
- Rather than add a fake web-flow user I've added this as an endpoint on /api/v1/signing-key.gpg
- [x] Try to match the default key with a user on gitea - this is done at verification time
- [x] Make things configurable?
- app.ini configuration done
- [x] when checking commits are signed need to check if they're actually verifiable too
- [x] Add documentation
I have decided that adjusting the docker to create a default gpg key is not the correct thing to do and therefore have not implemented this.
* Update golangci to v1.20
Signed-off-by: kolaente <k@knt.li>
* Use the timeout flag instead of deadline, move it to config
Signed-off-by: kolaente <k@knt.li>
* workaround broken swagger
only master brach is not working, latest release seems to work
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* make vendor
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* Don't export GO111MODULE
* set go-swagger to fixed release version
mentioned here: https://github.com/go-gitea/gitea/pull/7362#discussion_r300831537
Signed-off-by: Michael Gnehr <michael@gnehr.de>
New CSS linter which is much more powerfull than the previous one.
Configuration is default but I had to remove a few rules that were
throwing too many or weird errors.
More importantly, the linter will exit with code 1 on errors so now our
build will fail if the CSS linter fails which should eliminate linter
errors being introduced without notice.
* add 'npm' and 'npm-update' make targets and lockfile
- `make npm` installs and updates node_modules, triggered automatically
on `make css` and `make js` as it completes reasonably fast and
ensures consistent modules.
- `make npm-update` updates all dependencies to their latest version,
regenerates `node_modules` from scratch and updates
`package-lock.json`. It uses npm modules `updates` written by yours
truly to find the latest version of each dependency.
* add suggested make dependencies
* remove package-lock.json during npm-update
* regenerate package-lock.json
- Fix layout overflow in repo file list.
- Fix invisible status icon in file view and commit list. In file view,
the icon was moved to the left because I could not figure out a proper
fix because of HTML tables.
- Added title attribute to commit messages.
- Fixed two CSS linter warnings in existing CSS.
- Fixed CI variable check in 'make css'.
Fixes: https://github.com/go-gitea/gitea/issues/7180
* add make targets for js,css, add javascript linter
- add `make js`, deprecating `make javascripts`
- add `make css`, deprecating `make generate-stylesheets` and
`make stylesheets-check`
- changed the unclean css check to only run on CI
- add JS linting via eslint with basic configuration and fixed
discovered issues
- changed autoprefixer to use official `postcss-cli` avoiding the need
to loop in the makefile
- moved browserslist to package.json so other future tools can use it
too.
- update documentation for new make targets and added JS section
* fix indentation
* move functions used in html to 'exported' list
* Run lessc binary without having to install anything to node_modules
* use relative paths to node bin scripts, removing npx
* Revert "use relative paths to node bin scripts, removing npx"
This reverts commit 119b725525.
* fix lessc and postcss plugins
* check for node_modules and use actual bin names
* Prevent creating empty sessions
Signed-off-by: Andrew Thornton <art27@cantab.net>
* Update modules/setting/session.go
* Remove unnecessary option
Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add destory to list of ignored misspellings
* rename cookie.go -> virtual.go
* Delete old file
* Add test to ensure that sessions are not created without being logged in
Signed-off-by: Andrew Thornton <art27@cantab.net>
* fix tests
Signed-off-by: Andrew Thornton <art27@cantab.net>
* Update integrations/create_no_session_test.go
* Migrate to go modules
* make vendor
* Update mvdan.cc/xurls
* make vendor
* Update code.gitea.io/git
* make fmt-check
* Update github.com/go-sql-driver/mysql
* make vendor
* Added Go Path and node_modules to PATH
* Uses npx now for generate-stylesheets
* Uses `go env GOPATH` to calculate adding GOPATH/bin to PATH
* Added note about installing Node 8.0+ to generate stylesheets
* Added preferred Node version to CONTRIBUTING.md
* Add migration test
This commit adds a simple migration test for v1.5.3, v1.6.4 and v1.7.0-rc3
Signed-off-by: Andrew Thornton <art27@cantab.net>
* Automigrate based on available dbs
* remove old ini file
* Standardise the dialect names
* Added test environment for m$sql
* Added template for test environment for m$sql
* Fix password
* Fix password (again)
* Fix password (again again)
* Fix db
* Ci trigger (Looking at you drone....)
* Ci trigger (Looking at you drone....)
* Ci trigger (Looking at you drone....)
* Ci trigger (Looking at you drone....)
* Create master database for mssql integration tests
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Create database only if master do not exist
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Fix mssql integration tests by using custom database "gitea"
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Moved defer
* bump xorm
* updated xorm
* Fixed build
* Create manifest and serviceworker
* Create templates and add AppSubUrl
* Add JSRenderer
* fix ctx type
* Add JSRenderer to static.go
* Complete adding {{AppSubUrl}}
* Add more fonts to urlsToCache
* Add 512px and 192px icons
* Hardcode font MD5
* Default theme doesn't have a specific CSS file
This makes it easier for user who want to theme but
don't have the ability to know how to customize templates
all that is required is a change in a config option
The reason why I chose the DEFAULT_THEME as variable,
as perhaps in the future we will allow users to chose their
theme whon logged in just like we do with languages
* Update makefile to use dep
* Migrate to dep
* Fix some deps
* Try to find a better version for golang.org/x/net
* Try to find a better version for golang.org/x/oauth2
* Create docker/manifest/base.yml
serve as base for build docker image for most platform (386,amd64,arm,arm64)
* Add make task docker-multi-arch-push-manifest
To update references of a multi-arch image on docker registry.
* Use SED_INPLACE generic sed command
* Delete Dockerfile.aarch64
Delete Dockerfile.rpi
* Use gitea/gitea-base as base
and replace deprecated MAINTAINER by LABEL (https://docs.docker.com/engine/reference/builder/#maintainer-deprecated)
* Fix rebase
* Use sapk/gitea-base as base
* Split makefile for docker
* Fix version to v3.6
Could use in later version edge of alpine official library that support multi-arch for armhf.
* Remove sapk/gitea-base and use directly new official alpine multi-arch
* Move swagger interface under /api/v1
* Update swagger-ui
* Add /api/swagger and prepare for multiple api version
* Update test links
* Fix footer link
* Use standard lessc and minify CSS using Node.js
This changes the previous nonstandard `lessc` to the official one and
enables CSS minification via the clean-css module.
To build CSS, Node.js is required along with a `npm install` to get the
tools installed locally in node_modules so there is no dependency on
binaries in PATH. Benefits include:
- Allows one to have a standard lessc in PATH.
- Can now use command line switches on lessc.
- Minified CSS brings faster page load times and also has the benefit
of discouraging contributors from editing CSS directly.
To build CSS, Node.js is required along with a `npm install` to get the
tools installed locally based on the information in `package.json`.
The 'make stylesheet' task was modified to run without condition. This
makes it easier to work on the make task itself without having to delete
files.
Also fixes: https://github.com/go-gitea/gitea/issues/2198
* install node, npm and modules on drone
* .PHONY
* use 'minify' to minify CSS
* Cleaning up public/ and documenting js/css libs.
This commit mostly addresses #1484 by moving vendor'ed plugins into a
vendor/ directory and documenting their upstream source and license in
vendor/librejs.html.
This also proves gitea is using only open source js/css libraries which
helps toward reaching #1524.
* Removing unused css file.
The version of this file in use is located at:
vendor/plugins/highlight/github.css
* Cleaned up librejs.html and added javascript header
A SafeJS function was added to templates/helper.go to allow keeping
comments inside of javascript.
A javascript comment was added in the header of templates/base/head.tmpl
to mark all non-inline source as free.
The librejs.html file was updated to meet the current librejs spec. I
have now verified that the librejs plugin detects most of the scripts
included in gitea and suspect the non-free detections are the result of
a bug in the plugin. I believe this commit is enough to meet the C0.0
requirement of #1534.
* Updating SafeJS function per lint suggestion
* Added VERSIONS file, per request
To support High-DPI displays, generate images at 4 times their displayed
resolution, which should be enough to support all current devices
according to https://material.io/devices/.
* Use POSIX complaint ! operator in find
-not is a GNU extension and not all find(8) implementations
support it. It's just an alias for ! which is POSIX compliant.
Now gitea compiles on NetBSD at least.
* Revert change in vendor directory as requested
* Separate generate-swagger
* Remove go generate rules
* Add missing definition replacement + remove use of -i sed flag
for compatibility with mac os default sed version.
This is a little hacky a better solution could be use.
* Use custom SED_INPLACE
depending of platform detection
* Use SED_INPLACE for swagger-ui also
* Include formatting check to the `make check` rule
... and give it its own standalone target too (make fmt-check)
Show diff on fmt-check failure
Do not allow running "fmt-check" with incompatible go version
Also simplify the `fmt` rule
* Forbid running "make fmt" with Go version != 1.7 or 1.8
* Ignore bindata.go for spelling and formatting checks
also remove duplicated variable assignment for GOFILES
* Run `make fmt`
