Skip to content

Commit 91fa05b

Browse files
zjjhotzjjhot
committed
Merge remote-tracking branch 'giteaofficial/main'
* giteaofficial/main: (27 commits) fix github migration error when using multiple tokens (go-gitea#34144) Add package version api endpoints (go-gitea#34173) Fix incorrect file links (go-gitea#34189) Add cache for common package queries (go-gitea#22491) Allow admins and org owners to change org member public status (go-gitea#28294) Fix span svg layout (go-gitea#34185) fix webhook url (go-gitea#34186) Optimize overflow-menu (go-gitea#34183) Move and rename UpdateRepository (go-gitea#34136) Update milestones.tmpl (go-gitea#34184) [skip ci] Updated translations via Crowdin Refactor Git Attribute & performance optimization (go-gitea#34154) [skip ci] Updated translations via Crowdin fix(go-gitea#33711): cross-publish docker images to ghcr.io (go-gitea#34148) refactor organization menu (go-gitea#33928) feat: Add sorting by exclusive labels (issue priority) (go-gitea#33206) Fix vertical centering of file tree icons and use entryIcon for submodules/symlinks (go-gitea#34137) bugfix check for alternate ssh host certificate location (go-gitea#34146) Cache GPG keys, emails and users when list commits (go-gitea#34086) Set MERMAID_MAX_SOURCE_CHARACTERS to 50000 (go-gitea#34152) ...
2 parents 97a5712 + 8a6df00 commit 91fa05b

File tree

238 files changed

+4219
-3259
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

238 files changed

+4219
-3259
lines changed

‎.gitattributes

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
/assets/*.json linguist-generated
55
/public/assets/img/svg/*.svg linguist-generated
66
/templates/swagger/v1_json.tmpl linguist-generated
7+
/options/fileicon/** linguist-generated
78
/vendor/** -text -eol linguist-vendored
89
/web_src/js/vendor/** -text -eol linguist-vendored
910
Dockerfile.* linguist-language=Dockerfile

‎.github/workflows/release-nightly.yml

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,8 @@ jobs:
5959
aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
6060
nightly-docker-rootful:
6161
runs-on: namespace-profile-gitea-release-docker
62+
permissions:
63+
packages: write # to publish to ghcr.io
6264
steps:
6365
- uses: actions/checkout@v4
6466
# fetch all commits instead of only the last as some branches are long lived and could have many between versions
@@ -85,6 +87,12 @@ jobs:
8587
with:
8688
username: ${{ secrets.DOCKERHUB_USERNAME }}
8789
password: ${{ secrets.DOCKERHUB_TOKEN }}
90+
- name: Login to GHCR using PAT
91+
uses: docker/login-action@v3
92+
with:
93+
registry: ghcr.io
94+
username: ${{ github.repository_owner }}
95+
password: ${{ secrets.GITHUB_TOKEN }}
8896
- name: fetch go modules
8997
run: make vendor
9098
- name: build rootful docker image
@@ -93,9 +101,13 @@ jobs:
93101
context: .
94102
platforms: linux/amd64,linux/arm64
95103
push: true
96-
tags: gitea/gitea:${{ steps.clean_name.outputs.branch }}
104+
tags: |-
105+
gitea/gitea:${{ steps.clean_name.outputs.branch }}
106+
ghcr.io/go-gitea/gitea:${{ steps.clean_name.outputs.branch }}
97107
nightly-docker-rootless:
98108
runs-on: namespace-profile-gitea-release-docker
109+
permissions:
110+
packages: write # to publish to ghcr.io
99111
steps:
100112
- uses: actions/checkout@v4
101113
# fetch all commits instead of only the last as some branches are long lived and could have many between versions
@@ -122,6 +134,12 @@ jobs:
122134
with:
123135
username: ${{ secrets.DOCKERHUB_USERNAME }}
124136
password: ${{ secrets.DOCKERHUB_TOKEN }}
137+
- name: Login to GHCR using PAT
138+
uses: docker/login-action@v3
139+
with:
140+
registry: ghcr.io
141+
username: ${{ github.repository_owner }}
142+
password: ${{ secrets.GITHUB_TOKEN }}
125143
- name: fetch go modules
126144
run: make vendor
127145
- name: build rootless docker image
@@ -131,4 +149,6 @@ jobs:
131149
platforms: linux/amd64,linux/arm64
132150
push: true
133151
file: Dockerfile.rootless
134-
tags: gitea/gitea:${{ steps.clean_name.outputs.branch }}-rootless
152+
tags: |-
153+
gitea/gitea:${{ steps.clean_name.outputs.branch }}-rootless
154+
ghcr.io/go-gitea/gitea:${{ steps.clean_name.outputs.branch }}-rootless

‎.github/workflows/release-tag-rc.yml

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,8 @@ jobs:
6969
GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
7070
docker-rootful:
7171
runs-on: namespace-profile-gitea-release-docker
72+
permissions:
73+
packages: write # to publish to ghcr.io
7274
steps:
7375
- uses: actions/checkout@v4
7476
# fetch all commits instead of only the last as some branches are long lived and could have many between versions
@@ -79,7 +81,9 @@ jobs:
7981
- uses: docker/metadata-action@v5
8082
id: meta
8183
with:
82-
images: gitea/gitea
84+
images: |-
85+
gitea/gitea
86+
ghcr.io/go-gitea/gitea
8387
flavor: |
8488
latest=false
8589
# 1.2.3-rc0
@@ -90,6 +94,12 @@ jobs:
9094
with:
9195
username: ${{ secrets.DOCKERHUB_USERNAME }}
9296
password: ${{ secrets.DOCKERHUB_TOKEN }}
97+
- name: Login to GHCR using PAT
98+
uses: docker/login-action@v3
99+
with:
100+
registry: ghcr.io
101+
username: ${{ github.repository_owner }}
102+
password: ${{ secrets.GITHUB_TOKEN }}
93103
- name: build rootful docker image
94104
uses: docker/build-push-action@v5
95105
with:
@@ -100,6 +110,8 @@ jobs:
100110
labels: ${{ steps.meta.outputs.labels }}
101111
docker-rootless:
102112
runs-on: namespace-profile-gitea-release-docker
113+
permissions:
114+
packages: write # to publish to ghcr.io
103115
steps:
104116
- uses: actions/checkout@v4
105117
# fetch all commits instead of only the last as some branches are long lived and could have many between versions
@@ -110,7 +122,9 @@ jobs:
110122
- uses: docker/metadata-action@v5
111123
id: meta
112124
with:
113-
images: gitea/gitea
125+
images: |-
126+
gitea/gitea
127+
ghcr.io/go-gitea/gitea
114128
# each tag below will have the suffix of -rootless
115129
flavor: |
116130
latest=false
@@ -123,6 +137,12 @@ jobs:
123137
with:
124138
username: ${{ secrets.DOCKERHUB_USERNAME }}
125139
password: ${{ secrets.DOCKERHUB_TOKEN }}
140+
- name: Login to GHCR using PAT
141+
uses: docker/login-action@v3
142+
with:
143+
registry: ghcr.io
144+
username: ${{ github.repository_owner }}
145+
password: ${{ secrets.GITHUB_TOKEN }}
126146
- name: build rootless docker image
127147
uses: docker/build-push-action@v5
128148
with:

‎.github/workflows/release-tag-version.yml

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ concurrency:
1414
jobs:
1515
binary:
1616
runs-on: namespace-profile-gitea-release-binary
17+
permissions:
18+
packages: write # to publish to ghcr.io
1719
steps:
1820
- uses: actions/checkout@v4
1921
# fetch all commits instead of only the last as some branches are long lived and could have many between versions
@@ -71,6 +73,8 @@ jobs:
7173
GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
7274
docker-rootful:
7375
runs-on: namespace-profile-gitea-release-docker
76+
permissions:
77+
packages: write # to publish to ghcr.io
7478
steps:
7579
- uses: actions/checkout@v4
7680
# fetch all commits instead of only the last as some branches are long lived and could have many between versions
@@ -81,7 +85,9 @@ jobs:
8185
- uses: docker/metadata-action@v5
8286
id: meta
8387
with:
84-
images: gitea/gitea
88+
images: |-
89+
gitea/gitea
90+
ghcr.io/go-gitea/gitea
8591
# this will generate tags in the following format:
8692
# latest
8793
# 1
@@ -96,6 +102,12 @@ jobs:
96102
with:
97103
username: ${{ secrets.DOCKERHUB_USERNAME }}
98104
password: ${{ secrets.DOCKERHUB_TOKEN }}
105+
- name: Login to GHCR using PAT
106+
uses: docker/login-action@v3
107+
with:
108+
registry: ghcr.io
109+
username: ${{ github.repository_owner }}
110+
password: ${{ secrets.GITHUB_TOKEN }}
99111
- name: build rootful docker image
100112
uses: docker/build-push-action@v5
101113
with:
@@ -116,7 +128,9 @@ jobs:
116128
- uses: docker/metadata-action@v5
117129
id: meta
118130
with:
119-
images: gitea/gitea
131+
images: |-
132+
gitea/gitea
133+
ghcr.io/go-gitea/gitea
120134
# each tag below will have the suffix of -rootless
121135
flavor: |
122136
suffix=-rootless,onlatest=true
@@ -134,6 +148,12 @@ jobs:
134148
with:
135149
username: ${{ secrets.DOCKERHUB_USERNAME }}
136150
password: ${{ secrets.DOCKERHUB_TOKEN }}
151+
- name: Login to GHCR using PAT
152+
uses: docker/login-action@v3
153+
with:
154+
registry: ghcr.io
155+
username: ${{ github.repository_owner }}
156+
password: ${{ secrets.GITHUB_TOKEN }}
137157
- name: build rootless docker image
138158
uses: docker/build-push-action@v5
139159
with:

‎cmd/web.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,10 @@ func serveInstalled(ctx *cli.Context) error {
213213
log.Fatal("Can not find APP_DATA_PATH %q", setting.AppDataPath)
214214
}
215215

216+
// the AppDataTempDir is fully managed by us with a safe sub-path
217+
// so it's safe to automatically remove the outdated files
218+
setting.AppDataTempDir("").RemoveOutdated(3 * 24 * time.Hour)
219+
216220
// Override the provided port number within the configuration
217221
if ctx.IsSet("port") {
218222
if err := setPort(ctx.String("port")); err != nil {

‎custom/conf/app.example.ini

Lines changed: 4 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -197,13 +197,6 @@ RUN_USER = ; git
197197
;; relative paths are made absolute relative to the APP_DATA_PATH
198198
;SSH_SERVER_HOST_KEYS=ssh/gitea.rsa, ssh/gogs.rsa
199199
;;
200-
;; Directory to create temporary files in when testing public keys using ssh-keygen,
201-
;; default is the system temporary directory.
202-
;SSH_KEY_TEST_PATH =
203-
;;
204-
;; Use `ssh-keygen` to parse public SSH keys. The value is passed to the shell. By default, Gitea does the parsing itself.
205-
;SSH_KEYGEN_PATH =
206-
;;
207200
;; Enable SSH Authorized Key Backup when rewriting all keys, default is false
208201
;SSH_AUTHORIZED_KEYS_BACKUP = false
209202
;;
@@ -294,6 +287,9 @@ RUN_USER = ; git
294287
;; Default path for App data
295288
;APP_DATA_PATH = data ; relative paths will be made absolute with _`AppWorkPath`_
296289
;;
290+
;; Base path for App's temp files, leave empty to use the managed tmp directory in APP_DATA_PATH
291+
;APP_TEMP_PATH =
292+
;;
297293
;; Enable gzip compression for runtime-generated content, static resources excluded
298294
;ENABLE_GZIP = false
299295
;;
@@ -1069,15 +1065,6 @@ LEVEL = Info
10691065
;; Separate extensions with a comma. To line wrap files without an extension, just put a comma
10701066
;LINE_WRAP_EXTENSIONS = .txt,.md,.markdown,.mdown,.mkd,.livemd,
10711067

1072-
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
1073-
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
1074-
;[repository.local]
1075-
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
1076-
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
1077-
;;
1078-
;; Path for local repository copy. Defaults to `tmp/local-repo` (content gets deleted on gitea restart)
1079-
;LOCAL_COPY_PATH = tmp/local-repo
1080-
10811068
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
10821069
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
10831070
;[repository.upload]
@@ -1087,9 +1074,6 @@ LEVEL = Info
10871074
;; Whether repository file uploads are enabled. Defaults to `true`
10881075
;ENABLED = true
10891076
;;
1090-
;; Path for uploads. Defaults to `data/tmp/uploads` (content gets deleted on gitea restart)
1091-
;TEMP_PATH = data/tmp/uploads
1092-
;;
10931077
;; Comma-separated list of allowed file extensions (`.zip`), mime types (`text/plain`) or wildcard type (`image/*`, `audio/*`, `video/*`). Empty value or `*/*` allows all types.
10941078
;ALLOWED_TYPES =
10951079
;;
@@ -2473,7 +2457,7 @@ LEVEL = Info
24732457
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
24742458
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
24752459
;; Set the maximum number of characters in a mermaid source. (Set to -1 to disable limits)
2476-
;MERMAID_MAX_SOURCE_CHARACTERS = 5000
2460+
;MERMAID_MAX_SOURCE_CHARACTERS = 50000
24772461

24782462
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
24792463
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2594,9 +2578,6 @@ LEVEL = Info
25942578
;; Currently, only `minio` and `azureblob` is supported.
25952579
;SERVE_DIRECT = false
25962580
;;
2597-
;; Path for chunked uploads. Defaults to APP_DATA_PATH + `tmp/package-upload`
2598-
;CHUNKED_UPLOAD_PATH = tmp/package-upload
2599-
;;
26002581
;; Maximum count of package versions a single owner can have (`-1` means no limits)
26012582
;LIMIT_TOTAL_OWNER_COUNT = -1
26022583
;; Maximum size of packages a single owner can use (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)

‎docker/root/etc/s6/openssh/setup

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,16 +31,19 @@ if [ -e /data/ssh/ssh_host_ecdsa_cert ]; then
3131
SSH_ECDSA_CERT=${SSH_ECDSA_CERT:-"/data/ssh/ssh_host_ecdsa_cert"}
3232
fi
3333

34-
if [ -e /data/ssh/ssh_host_ed25519-cert.pub ]; then
35-
SSH_ED25519_CERT=${SSH_ED25519_CERT:-"/data/ssh/ssh_host_ed25519-cert.pub"}
34+
# In case someone wants to sign the `{keyname}.pub` key by `ssh-keygen -s ca -I identity ...` to
35+
# make use of the ssh-key certificate authority feature (see ssh-keygen CERTIFICATES section),
36+
# the generated key file name is `{keyname}-cert.pub`
37+
if [ -e /data/ssh/ssh_host_ed25519_key-cert.pub ]; then
38+
SSH_ED25519_CERT=${SSH_ED25519_CERT:-"/data/ssh/ssh_host_ed25519_key-cert.pub"}
3639
fi
3740

38-
if [ -e /data/ssh/ssh_host_rsa-cert.pub ]; then
39-
SSH_RSA_CERT=${SSH_RSA_CERT:-"/data/ssh/ssh_host_rsa-cert.pub"}
41+
if [ -e /data/ssh/ssh_host_rsa_key-cert.pub ]; then
42+
SSH_RSA_CERT=${SSH_RSA_CERT:-"/data/ssh/ssh_host_rsa_key-cert.pub"}
4043
fi
4144

42-
if [ -e /data/ssh/ssh_host_ecdsa-cert.pub ]; then
43-
SSH_ECDSA_CERT=${SSH_ECDSA_CERT:-"/data/ssh/ssh_host_ecdsa-cert.pub"}
45+
if [ -e /data/ssh/ssh_host_ecdsa_key-cert.pub ]; then
46+
SSH_ECDSA_CERT=${SSH_ECDSA_CERT:-"/data/ssh/ssh_host_ecdsa_key-cert.pub"}
4447
fi
4548

4649
if [ -d /etc/ssh ]; then

‎models/asymkey/gpg_key.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,3 +240,10 @@ func DeleteGPGKey(ctx context.Context, doer *user_model.User, id int64) (err err
240240

241241
return committer.Commit()
242242
}
243+
244+
func FindGPGKeyWithSubKeys(ctx context.Context, keyID string) ([]*GPGKey, error) {
245+
return db.Find[GPGKey](ctx, FindGPGKeyOptions{
246+
KeyID: keyID,
247+
IncludeSubKeys: true,
248+
})
249+
}

‎models/asymkey/ssh_key_fingerprint.go

Lines changed: 2 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -6,27 +6,13 @@ package asymkey
66
import (
77
"context"
88
"fmt"
9-
"strings"
109

1110
"code.gitea.io/gitea/models/db"
12-
"code.gitea.io/gitea/modules/log"
13-
"code.gitea.io/gitea/modules/process"
14-
"code.gitea.io/gitea/modules/setting"
15-
"code.gitea.io/gitea/modules/util"
1611

1712
"golang.org/x/crypto/ssh"
1813
"xorm.io/builder"
1914
)
2015

21-
// ___________.__ .__ __
22-
// \_ _____/|__| ____ ____ ________________________|__| _____/ |_
23-
// | __) | |/ \ / ___\_/ __ \_ __ \____ \_ __ \ |/ \ __\
24-
// | \ | | | \/ /_/ > ___/| | \/ |_> > | \/ | | \ |
25-
// \___ / |__|___| /\___ / \___ >__| | __/|__| |__|___| /__|
26-
// \/ \//_____/ \/ |__| \/
27-
//
28-
// This file contains functions for fingerprinting SSH keys
29-
//
3016
// The database is used in checkKeyFingerprint however most of these functions probably belong in a module
3117

3218
// checkKeyFingerprint only checks if key fingerprint has been used as public key,
@@ -41,29 +27,6 @@ func checkKeyFingerprint(ctx context.Context, fingerprint string) error {
4127
return nil
4228
}
4329

44-
func calcFingerprintSSHKeygen(publicKeyContent string) (string, error) {
45-
// Calculate fingerprint.
46-
tmpPath, err := writeTmpKeyFile(publicKeyContent)
47-
if err != nil {
48-
return "", err
49-
}
50-
defer func() {
51-
if err := util.Remove(tmpPath); err != nil {
52-
log.Warn("Unable to remove temporary key file: %s: Error: %v", tmpPath, err)
53-
}
54-
}()
55-
stdout, stderr, err := process.GetManager().Exec("AddPublicKey", "ssh-keygen", "-lf", tmpPath)
56-
if err != nil {
57-
if strings.Contains(stderr, "is not a public key file") {
58-
return "", ErrKeyUnableVerify{stderr}
59-
}
60-
return "", util.NewInvalidArgumentErrorf("'ssh-keygen -lf %s' failed with error '%s': %s", tmpPath, err, stderr)
61-
} else if len(stdout) < 2 {
62-
return "", util.NewInvalidArgumentErrorf("not enough output for calculating fingerprint: %s", stdout)
63-
}
64-
return strings.Split(stdout, " ")[1], nil
65-
}
66-
6730
func calcFingerprintNative(publicKeyContent string) (string, error) {
6831
// Calculate fingerprint.
6932
pk, _, _, _, err := ssh.ParseAuthorizedKey([]byte(publicKeyContent))
@@ -75,15 +38,12 @@ func calcFingerprintNative(publicKeyContent string) (string, error) {
7538

7639
// CalcFingerprint calculate public key's fingerprint
7740
func CalcFingerprint(publicKeyContent string) (string, error) {
78-
// Call the method based on configuration
79-
useNative := setting.SSH.KeygenPath == ""
80-
calcFn := util.Iif(useNative, calcFingerprintNative, calcFingerprintSSHKeygen)
81-
fp, err := calcFn(publicKeyContent)
41+
fp, err := calcFingerprintNative(publicKeyContent)
8242
if err != nil {
8343
if IsErrKeyUnableVerify(err) {
8444
return "", err
8545
}
86-
return "", fmt.Errorf("CalcFingerprint(%s): %w", util.Iif(useNative, "native", "ssh-keygen"), err)
46+
return "", fmt.Errorf("CalcFingerprint: %w", err)
8747
}
8848
return fp, nil
8949
}

0 commit comments

Comments
 (0)