Gitea not verifying commit signature

[lmtr0]

Description

Hey there, good day!

Recently I started using GitButler as my main git client, however gitea can't verify it's signatures on the platform (See screenshots bellow). Locally with git everything works, and I verified my key and email in the ui.

Gitea Version

1.23.8

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

Here is a screenshot of the commit.

However, a git commit works:

Locally with the Git CLI, all the signatures work fine:

I spoke with the GitButtler team and they said:

Git Version

GitButler latest

Operating System

Linux

How are you running Gitea?

Inside a docker environment on a private cloud with default configuration

Database

None

[techknowlogick]

Are you able to provide a .patch file of an example commit?

[lmtr0]

Hello @techknowlogick,

I couldn't get the signature to be outputed after 20 min so I gave up.
In https://gist.github.com/lmtr0/4ddc84e9f19f885a58315d3b5c1bd7c3 you will find:

• example.patch from git show <commit from gitbutler> > example.patch
• example-show-signature.patch from git show --show-signature <same commit as above> > example-show-signature.patch

However, if you provide me with the command that will show you the information you want I would be happy to provide the output

[Byron]

Here is the git cat-file …| pbcopy output of a signed commit created by GitButler, maybe it's useful.

tree a29321bf9e3ec433ed9e47b1cbbac6906c71fc60
parent c0d83043ade7fa3ca10659608799477e9daa670b
author Sebastian Thiel <sebastian.thiel@icloud.com> 1747920681 +0200
committer Sebastian Thiel <sebastian.thiel@icloud.com> 1748010747 +0200
gitbutler-headers-version 2
gitbutler-change-id 1063f7ea-d841-43b3-903a-01747681c40d
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE6vnM/NCHZAjyl8YKnLXueJXoJosFAmgwhvsACgkQnLXueJXo
 JovXUxAAq0WKJILCUAxyhwh5tRdxJTB2NjiCLf+ggLfjyrWPtMWPi/YUt7iGPB2H
 Wbv9U7l5t+54fPX8TQtBKZ79YaDMfYdjlfDSijmPruf8/MXB4G0rAaIajtCr0usZ
 kJDOgmmYS7bVMybDe6guwFZappiuSS2dCEYgeJun+q7Y6IYsfvdAluJmGubQIkPT
 rrEffqoQz3URmDYnAKW3sTRUVwCkYIJDxpl/W0Rvc0jmELdkHu7JYX7XvZBYSUDq
 FWgzCPjyErtkKk8AqoeWtTCpL+9ozzNIXNRKjGCOL2LG4H/uuNFdM46HB+KW/7+B
 wMGcpZk8T/zN9Cf348M+y+o09QX1OWavDS6LgvWJaDtG/swgxV96KKR5lEtdd1IU
 JHuXfPUfGp4r378FIrbPK+Thu5bn9Yq8qGvdZOpTqDxHPU9/o9wLpJghcWJZ5O3X
 MpK4HdN+bME2zgBd08QsOjANogbJIz9MVaMGRFlCO5iOiz2DxG+v2KkO8IRwGXaO
 OKKQ7BD04fS2wFma862BaTtB9M9f9UTWV4e2mgRpSDJWTQKrj+HkJ63gAFQYFnfp
 ppgqZLkmzH1Ta2U56JSMMfOoKVFgjuxRx1d+tzdC+TpQyo06NI1KkNMepK1rhFBW
 p8hej6n/7Bl9LL/W+DKsNqW9jQbTYu66JqKs3Kg7xga6w/ss0iw=
 =VG6I
 -----END PGP SIGNATURE-----

asdf
asdf
asdf

[wxiaoguang]

Here, it needs to add these "gitbutler" headers into "payloadSB"

(Update: maybe it needs to rewrite the "commit_reader", the existing logic doesn't seem right)

gitea/modules/git/commit_reader.go

Lines 86 to 94 in 9d4ebc1

	case "encoding":
	_, _ = payloadSB.Write(line)
	case "gpgsig":
	fallthrough
	case "gpgsig-sha256": // FIXME: no intertop, so only 1 exists at present.
	_, _ = signatureSB.Write(data)
	_ = signatureSB.WriteByte('\n')
	pgpsig = true
	}

[wxiaoguang]

-> Refactor commit reader #34542

[wxiaoguang]

The fix is in main branch now. It will be backported to 1.24

[wxiaoguang]

You can try 1.24-nightly now (it will be 1.24.0 soon and contains the fix)

• https://dl.gitea.com/gitea/1.24-nightly/
• https://hub.docker.com/r/gitea/gitea/tags?name=1.24-nightly

[lmtr0]

Thank you, @wxiaoguang, for the quick response, implementation and now release, and thanks to @Byron for the helpful resources.

As soon as the fix gets to stable I will check it out