Allow pushmirror to use publickey authentication #18835

Gusted · 2022-02-20T11:01:59Z

Adds the option to use let the pushmirror use publickey authentication for push actions instead of using user:password authentication. The Publickey algorithm uses for this is ed25519, and is saved in OpenSSH's format so it can be used directly with git.
Resolves Push mirror using public key authorization #18159

Gusted · 2022-02-20T11:23:31Z

@wxiaoguang I've changed my comment to reflect a more accurate representation. Sorry for the confusion.

wxiaoguang · 2022-02-20T11:25:43Z

No need to say sorry .... 😊 I just hope most people can realize the fact, and make Gitea frontend get rid of the current nobody-cares situation.

- Remember, don't escape in arguments.

services/mirror/mirror_push.go

- Also un-comment remove part.

Gusted · 2022-02-20T15:05:55Z

Ready for review... I'm not sure how to handle the UI to display the long ssh key.

web_src/js/features/repo-settings.js

codecov-commenter · 2022-02-20T15:21:29Z

Codecov Report

Merging #18835 (801741d) into main (a3d55ac) will increase coverage by 0.01%.
The diff coverage is 60.87%.

@@            Coverage Diff             @@
##             main   #18835      +/-   ##
==========================================
+ Coverage   46.93%   46.95%   +0.01%     
==========================================
  Files         977      979       +2     
  Lines      135302   135609     +307     
==========================================
+ Hits        63508    63672     +164     
- Misses      64012    64132     +120     
- Partials     7782     7805      +23

Impacted Files	Coverage Δ
cmd/dump.go	`0.67% <ø> (ø)`
models/repo/pushmirror.go	`78.00% <ø> (ø)`
modules/context/package.go	`48.27% <0.00%> (-8.49%)`	⬇️
modules/lfs/content_store.go	`74.66% <ø> (+4.66%)`	⬆️
modules/packages/container/metadata.go	`76.92% <ø> (ø)`
routers/web/org/setting.go	`0.00% <0.00%> (ø)`
routers/web/repo/packages.go	`0.00% <0.00%> (ø)`
routers/web/repo/setting.go	`16.70% <0.00%> (-0.23%)`	⬇️
routers/web/user/setting/account.go	`25.65% <0.00%> (-0.12%)`	⬇️
routers/web/user/setting/profile.go	`35.36% <0.00%> (-0.44%)`	⬇️
... and 48 more

Help us with your feedback. Take ten seconds to tell us how you rate us.

Gusted · 2022-02-20T15:25:56Z

Force-pushed twice, because git was being funny.

models/migrations/v226.go

zeripath · 2022-08-22T18:50:57Z

models/repo/pushmirror.go

@@ -26,6 +27,10 @@ type PushMirror struct {
 	Repo       *Repository `xorm:"-"`
 	RemoteName string

+	// A keypair formatted in OpenSSH format.
+	PublicKey  string


This will be a TEXT field on MySQL which is potentially too small for an RSA key - how big is the potential representation for ED25519 keys?

I once run a script with the old code in modules/crypto/ed25519.go to generate a few million private keys and get their max length. IIRC it was 387, so I just got at 400 to be safe.

Public keys are: ssh-ed25519 + base64 of the ssh's marshaled of the public key bytes + new line And should result in a max of 81 bytes per the analysis of the code (we likely should have a test that verifies these lengths)

Might still want to enlarge it now to accomodate future key formats. There's no need to define database fields so tightly.

I'm not able to guess future key formats. I prefer to just limit it to Ed25519 signatures and only add other signatures scheme if there's a need for them.

If we enlarge now, it saves us from the pain of a future migration. So, unless this is a critical performance code path where there are indexing benefits by using the smaller type, I would enlarge.

Alright then, I give in. What would be a good size to use here?

Correct, MySQL TEXT should be limited to 65535 bytes, which seems plenty. So this is LGTM.

Signed-off-by: Andrew Thornton <[email protected]>

templates/repo/settings/options.tmpl

web_src/js/features/repo-settings.js

Co-authored-by: silverwind <[email protected]>

web_src/js/features/repo-legacy.js

lunny · 2022-10-20T08:56:59Z

Please resolve the conflicts.

Co-authored-by: silverwind <[email protected]>

elipsion · 2023-01-13T15:39:10Z

@Gusted Is this PR abandoned? Do you need any help finishing up the merge conflicts?

Gusted · 2023-02-09T15:46:32Z

@Gusted Is this PR abandoned? Do you need any help finishing up the merge conflicts?

No, the merge conflicts aren't the problem. Rather that I forgot that Git-LFS exists, which is way harder to support with SSH. I'm not knowledgeable enough about LFS to even try add support for it.

elipsion · 2023-02-20T08:35:05Z

No, the merge conflicts aren't the problem. Rather that I forgot that Git-LFS exists, which is way harder to support with SSH. I'm not knowledgeable enough about LFS to even try add support for it.

Would it be possible to implement push mirrors without support for Git-LFS and leave that feature for the future? There are a fair number of repositories that doesn't require it, so the implementation would not be wasted.

puni9869 · 2023-09-01T06:25:06Z

👀

denyskon · 2024-01-15T21:19:50Z

@Gusted Are you still willing to work on this PR? I think this feature would be a great addition even without Git LFS support. I see that you suggested to force HTTP auth for LFS-enabled repos - I think this would be an acceptable approach.

If you still want to continue with this PR, please resolve merge conflicts and maybe we could merge it soon.

philip-peterson · 2024-08-03T17:31:22Z

@Gusted Any way I can help? I am also interested in pushing this through to the finish line. I know a lot about LFS.

denyskon · 2024-08-04T13:34:03Z

@philip-peterson AFAIK this contributor is now rather more active over at Forgejo. As there was no response in a while, we can consider this PR as abandoned.

As this feature still would be a valuable addition, it would be great if you or somebody else could take over this PR.

techknowlogick · 2024-08-04T17:55:20Z

I'll close this PR for those reasons. Im refactoring other code areas that might make this easier anyway

Gusted added 5 commits February 19, 2022 16:26

Add cryptographic code part

eefa9e5

Simply code

81d5e26

Proto-typing UI

4e1731a

Polish UI further & add backend for SSH Keys

560494a

Merge branch 'main' into publickey-auth-push-mirror

0631c76

Gusted mentioned this pull request Feb 20, 2022

Push mirror using public key authorization #18159

Open

Fix typo

f8b28db

This comment was marked as outdated.

Sign in to view

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Feb 20, 2022

Gusted added 4 commits February 20, 2022 15:21

Big Refactor

3dcf98e

Remove left-over

17e6ae8

3 hour wasted commit

25bd4db

- Remember, don't escape in arguments.

Fix copy command

c627b15

wxiaoguang reviewed Feb 20, 2022

View reviewed changes

services/mirror/mirror_push.go Outdated Show resolved Hide resolved

Gusted added 3 commits February 20, 2022 15:46

Fix linting

37f5359

Apply feedback

ed6e4f8

- Also un-comment remove part.

Merge branch 'main' into publickey-auth-push-mirror

7acceb2

Gusted marked this pull request as ready for review February 20, 2022 15:05

Gusted added the type/feature Completely new functionality. Can only be merged if feature freeze is not active. label Feb 20, 2022

wxiaoguang reviewed Feb 20, 2022

View reviewed changes

web_src/js/features/repo-settings.js Outdated Show resolved Hide resolved

Remove JS

b2653cd

Gusted force-pushed the publickey-auth-push-mirror branch from b0e7a61 to f3bbdcc Compare February 20, 2022 15:24

Remove left-overs

af81b21

Gusted force-pushed the publickey-auth-push-mirror branch from f3bbdcc to af81b21 Compare February 20, 2022 15:25

Use i18n

6bcd6ba

GiteaBot added the lgtm/need 1 This PR needs approval from one additional maintainer to be merged. label Aug 22, 2022

zeripath reviewed Aug 22, 2022

View reviewed changes

models/migrations/v226.go Show resolved Hide resolved

zeripath reviewed Aug 22, 2022

View reviewed changes

Add some comments and slightly restructure

81e1e96

Signed-off-by: Andrew Thornton <[email protected]>

silverwind reviewed Sep 7, 2022

View reviewed changes

templates/repo/settings/options.tmpl Outdated Show resolved Hide resolved

silverwind reviewed Sep 7, 2022

View reviewed changes

web_src/js/features/repo-settings.js Outdated Show resolved Hide resolved

Gusted and others added 3 commits October 1, 2022 20:49

Apply suggestions from code review

e129fb5

Co-authored-by: silverwind <[email protected]>

Make disabled class work

2622046

Merge branch 'main' into publickey-auth-push-mirror

9064406

silverwind reviewed Oct 20, 2022

View reviewed changes

web_src/js/features/repo-legacy.js Outdated Show resolved Hide resolved

silverwind approved these changes Oct 20, 2022

View reviewed changes

GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Oct 20, 2022

Update web_src/js/features/repo-legacy.js

ba1e6a1

Co-authored-by: silverwind <[email protected]>

lunny modified the milestones: 1.18.0, 1.19.0 Oct 23, 2022

lunny removed this from the 1.19.0 milestone Feb 1, 2023

wxiaoguang added the status/blocked This PR cannot be merged yet, i.e. because it depends on another unmerged PR label May 4, 2023

denyskon added the issue/needs-feedback For bugs, we need more details. For features, the feature must be described in more detail label Jan 15, 2024

techknowlogick closed this Aug 4, 2024

go-gitea locked and limited conversation to collaborators Aug 4, 2024

Uh oh!

Allow pushmirror to use publickey authentication #18835

Allow pushmirror to use publickey authentication #18835

Uh oh!

Conversation

Gusted commented Feb 20, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Gusted commented Feb 20, 2022

Uh oh!

wxiaoguang commented Feb 20, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Gusted commented Feb 20, 2022

Uh oh!

Uh oh!

codecov-commenter commented Feb 20, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Gusted commented Feb 20, 2022

Uh oh!

Uh oh!

zeripath Aug 22, 2022

Choose a reason for hiding this comment

Uh oh!

Gusted Aug 27, 2022

Choose a reason for hiding this comment

Uh oh!

silverwind Sep 7, 2022

Choose a reason for hiding this comment

Uh oh!

Gusted Oct 1, 2022

Choose a reason for hiding this comment

Uh oh!

silverwind Oct 17, 2022

Choose a reason for hiding this comment

Uh oh!

Gusted Oct 20, 2022

Choose a reason for hiding this comment

Uh oh!

silverwind Oct 20, 2022

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lunny commented Oct 20, 2022

Uh oh!

elipsion commented Jan 13, 2023

Uh oh!

Gusted commented Feb 9, 2023

Uh oh!

elipsion commented Feb 20, 2023

Uh oh!

puni9869 commented Sep 1, 2023

Uh oh!

denyskon commented Jan 15, 2024

Uh oh!

philip-peterson commented Aug 3, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

denyskon commented Aug 4, 2024

Uh oh!

techknowlogick commented Aug 4, 2024

Uh oh!

Uh oh!

Gusted commented Feb 20, 2022 •

edited

Loading

wxiaoguang commented Feb 20, 2022 •

edited

Loading

codecov-commenter commented Feb 20, 2022 •

edited

Loading

philip-peterson commented Aug 3, 2024 •

edited

Loading