Improve instance wide ssh commit signing

* Signed SSH commits can look like on GitHub
* No user account of the committer needed
* SSH format can be added in gitea config
* No gitconfig changes needed
* Set gpg.format git key for signing command
* Previously only the default gpg key had global trust in Gitea
  * SSH Signing worked before with DEFAULT_TRUST_MODEL=committer, but not with model default and manually changing the .gitconfig

e.g. the following is all needed
```
[repository.signing]
SIGNING_KEY = /data/id_ed25519.pub
SIGNING_NAME = Gitea
SIGNING_EMAIL = [email protected]
SIGNING_FORMAT = ssh
INITIAL_COMMIT = always
CRUD_ACTIONS = always
WIKI = always
MERGES = always
```

`TRUSTED_SSH_KEYS` can be a list of additional ssh public keys to trust for every user of this instance

Author: ChristopherHX

models/asymkey/key.go

@@ -0,0 +1,6 @@
+package asymkey
+
+type SigningKey struct {
+	KeyID  string
+	Format string
+}

modules/git/command.go

@@ -47,6 +47,7 @@ type Command struct {
 	globalArgsLength int
 	brokenArgs       []string
 	cmd              *exec.Cmd // for debug purpose only
+	configArgs       []string
 }
 
 func logArgSanitize(arg string) string {
@@ -196,6 +197,15 @@ func (c *Command) AddDashesAndList(list ...string) *Command {
 	return c
 }
 
+func (c *Command) AddConfig(key string, value string) *Command {
+	kv := key + "=" + value
+	if !isSafeArgumentValue(kv) {
+		c.brokenArgs = append(c.brokenArgs, key)
+	}
+	c.configArgs = append(c.configArgs, "-c", kv)
+	return c
+}
+
 // ToTrustedCmdArgs converts a list of strings (trusted as argument) to TrustedCmdArgs
 // In most cases, it shouldn't be used. Use NewCommand().AddXxx() function instead
 func ToTrustedCmdArgs(args []string) TrustedCmdArgs {
@@ -321,7 +331,7 @@ func (c *Command) run(ctx context.Context, skip int, opts *RunOpts) error {
 
 	startTime := time.Now()
 
-	cmd := exec.CommandContext(ctx, c.prog, c.args...)
+	cmd := exec.CommandContext(ctx, c.prog, append(append([]string{}, c.configArgs...), c.args...)...)
 	c.cmd = cmd // for debug purpose only
 	if opts.Env == nil {
 		cmd.Env = os.Environ()

modules/git/repo.go

@@ -28,6 +28,7 @@ type GPGSettings struct {
 	Email            string
 	Name             string
 	PublicKeyContent string
+	Format           string
 }
 
 const prettyLogFormat = `--pretty=format:%H`

modules/git/repo_gpg.go

@@ -6,13 +6,22 @@ package git
 
 import (
 	"fmt"
+	"os"
 	"strings"
 
 	"code.gitea.io/gitea/modules/process"
 )
 
 // LoadPublicKeyContent will load the key from gpg
 func (gpgSettings *GPGSettings) LoadPublicKeyContent() error {
+	if gpgSettings.Format == "ssh" {
+		content, err := os.ReadFile(gpgSettings.KeyID)
+		if err != nil {
+			return fmt.Errorf("unable to read SSH public key file: %s, %w", gpgSettings.KeyID, err)
+		}
+		gpgSettings.PublicKeyContent = string(content)
+		return nil
+	}
 	content, stderr, err := process.GetManager().Exec(
 		"gpg -a --export",
 		"gpg", "-a", "--export", gpgSettings.KeyID)
@@ -44,6 +53,9 @@ func (repo *Repository) GetDefaultPublicGPGKey(forceUpdate bool) (*GPGSettings,
 	signingKey, _, _ := NewCommand("config", "--get", "user.signingkey").RunStdString(repo.Ctx, &RunOpts{Dir: repo.Path})
 	gpgSettings.KeyID = strings.TrimSpace(signingKey)
 
+	format, _, _ := NewCommand("config", "--get", "gpg.format").RunStdString(repo.Ctx, &RunOpts{Dir: repo.Path})
+	gpgSettings.Format = strings.TrimSpace(format)
+
 	defaultEmail, _, _ := NewCommand("config", "--get", "user.email").RunStdString(repo.Ctx, &RunOpts{Dir: repo.Path})
 	gpgSettings.Email = strings.TrimSpace(defaultEmail)
 

modules/git/repo_tree.go

@@ -16,6 +16,7 @@ type CommitTreeOpts struct {
 	Parents    []string
 	Message    string
 	KeyID      string
+	KeyFormat  string
 	NoGPGSign  bool
 	AlwaysSign bool
 }
@@ -44,6 +45,9 @@ func (repo *Repository) CommitTree(author, committer *Signature, tree *Tree, opt
 	_, _ = messageBytes.WriteString("\n")
 
 	if opts.KeyID != "" || opts.AlwaysSign {
+		if opts.KeyFormat != "" {
+			cmd.AddConfig("gpg.format", opts.KeyFormat)
+		}
 		cmd.AddOptionFormat("-S%s", opts.KeyID)
 	}
 

modules/setting/repository.go

@@ -100,11 +100,13 @@ var (
 			SigningKey        string
 			SigningName       string
 			SigningEmail      string
+			SigningFormat     string
 			InitialCommit     []string
 			CRUDActions       []string `ini:"CRUD_ACTIONS"`
 			Merges            []string
 			Wiki              []string
 			DefaultTrustModel string
+			TrustedSSHKeys    []string `ini:"TRUSTED_SSH_KEYS"`
 		} `ini:"repository.signing"`
 	}{
 		DetectedCharsetsOrder: []string{
@@ -242,11 +244,13 @@ var (
 			SigningKey        string
 			SigningName       string
 			SigningEmail      string
+			SigningFormat     string
 			InitialCommit     []string
 			CRUDActions       []string `ini:"CRUD_ACTIONS"`
 			Merges            []string
 			Wiki              []string
 			DefaultTrustModel string
+			TrustedSSHKeys    []string `ini:"TRUSTED_SSH_KEYS"`
 		}{
 			SigningKey:        "default",
 			SigningName:       "",
@@ -256,6 +260,7 @@ var (
 			Merges:            []string{"pubkey", "twofa", "basesigned", "commitssigned"},
 			Wiki:              []string{"never"},
 			DefaultTrustModel: "collaborator",
+			TrustedSSHKeys:    []string{},
 		},
 	}
 	RepoRootPath string

routers/api/v1/api.go

@@ -972,6 +972,7 @@ func Routes() *web.Router {
 		m.Group("", func() {
 			m.Get("/version", misc.Version)
 			m.Get("/signing-key.gpg", misc.SigningKey)
+			m.Get("/signing-key.pub", misc.SigningKeySSH)
 			m.Post("/markup", reqToken(), bind(api.MarkupOption{}), misc.Markup)
 			m.Post("/markdown", reqToken(), bind(api.MarkdownOption{}), misc.Markdown)
 			m.Post("/markdown/raw", reqToken(), misc.MarkdownRaw)

routers/api/v1/misc/signing.go

@@ -50,11 +50,70 @@ func SigningKey(ctx *context.APIContext) {
 		path = ctx.Repo.Repository.RepoPath()
 	}
 
-	content, err := asymkey_service.PublicSigningKey(ctx, path)
+	content, format, err := asymkey_service.PublicSigningKey(ctx, path)
 	if err != nil {
 		ctx.APIErrorInternal(err)
 		return
 	}
+	if format == "ssh" {
+		ctx.APIErrorNotFound(fmt.Errorf("SSH keys are used for signing, not GPG"))
+		return
+	}
+	_, err = ctx.Write([]byte(content))
+	if err != nil {
+		ctx.APIErrorInternal(fmt.Errorf("Error writing key content %w", err))
+	}
+}
+
+// SigningKey returns the public key of the default signing key if it exists
+func SigningKeySSH(ctx *context.APIContext) {
+	// swagger:operation GET /signing-key.pub miscellaneous getSigningKeySSH
+	// ---
+	// summary: Get default signing-key.pub
+	// produces:
+	//     - text/plain
+	// responses:
+	//   "200":
+	//     description: "ssh public key"
+	//     schema:
+	//       type: string
+
+	// swagger:operation GET /repos/{owner}/{repo}/signing-key.pub repository repoSigningKeySSH
+	// ---
+	// summary: Get signing-key.pub for given repository
+	// produces:
+	//     - text/plain
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
+	// responses:
+	//   "200":
+	//     description: "ssh public key"
+	//     schema:
+	//       type: string
+
+	path := ""
+	if ctx.Repo != nil && ctx.Repo.Repository != nil {
+		path = ctx.Repo.Repository.RepoPath()
+	}
+
+	content, format, err := asymkey_service.PublicSigningKey(ctx, path)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	if format != "ssh" {
+		ctx.APIErrorNotFound(fmt.Errorf("GPG keys are used for signing, not SSH"))
+		return
+	}
 	_, err = ctx.Write([]byte(content))
 	if err != nil {
 		ctx.APIErrorInternal(fmt.Errorf("Error writing key content %w", err))

routers/web/repo/setting/setting.go

@@ -62,7 +62,7 @@ func SettingsCtxData(ctx *context.Context) {
 	ctx.Data["CanConvertFork"] = ctx.Repo.Repository.IsFork && ctx.Doer.CanCreateRepoIn(ctx.Repo.Repository.Owner)
 
 	signing, _ := asymkey_service.SigningKey(ctx, ctx.Repo.Repository.RepoPath())
-	ctx.Data["SigningKeyAvailable"] = len(signing) > 0
+	ctx.Data["SigningKeyAvailable"] = len(signing.KeyID) > 0
 	ctx.Data["SigningSettings"] = setting.Repository.Signing
 	ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled
 
@@ -105,7 +105,7 @@ func SettingsPost(ctx *context.Context) {
 	ctx.Data["MinimumMirrorInterval"] = setting.Mirror.MinInterval
 
 	signing, _ := asymkey_service.SigningKey(ctx, ctx.Repo.Repository.RepoPath())
-	ctx.Data["SigningKeyAvailable"] = len(signing) > 0
+	ctx.Data["SigningKeyAvailable"] = len(signing.KeyID) > 0
 	ctx.Data["SigningSettings"] = setting.Repository.Signing
 	ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled
 

services/asymkey/commit.go

@@ -398,11 +398,79 @@ func ParseCommitWithSSHSignature(ctx context.Context, c *git.Commit, committer *
 			}
 		}
 	}
+	// Trust more than one key for every User
+	for _, k := range setting.Repository.Signing.TrustedSSHKeys {
+		fingerprint, _ := asymkey_model.CalcFingerprint(k)
+		commitVerification := verifySSHCommitVerification(c.Signature.Signature, c.Signature.Payload, &asymkey_model.PublicKey{
+			Verified:    true,
+			Content:     k,
+			Fingerprint: fingerprint,
+			HasUsed:     true,
+		}, committer, committer, c.Committer.Email)
+		if commitVerification != nil {
+			return commitVerification
+		}
+	}
+
+	defaultReason := asymkey_model.NoKeyFound
+
+	if setting.Repository.Signing.SigningFormat == "ssh" && setting.Repository.Signing.SigningKey != "" && setting.Repository.Signing.SigningKey != "default" && setting.Repository.Signing.SigningKey != "none" {
+		// OK we should try the default key
+		gpgSettings := git.GPGSettings{
+			Sign:   true,
+			KeyID:  setting.Repository.Signing.SigningKey,
+			Name:   setting.Repository.Signing.SigningName,
+			Email:  setting.Repository.Signing.SigningEmail,
+			Format: setting.Repository.Signing.SigningFormat,
+		}
+		if err := gpgSettings.LoadPublicKeyContent(); err != nil {
+			log.Error("Error getting default signing key: %s %v", gpgSettings.KeyID, err)
+		}
+		fingerprint, _ := asymkey_model.CalcFingerprint(gpgSettings.PublicKeyContent)
+		if commitVerification := verifySSHCommitVerification(c.Signature.Signature, c.Signature.Payload, &asymkey_model.PublicKey{
+			Verified:    true,
+			Content:     gpgSettings.PublicKeyContent,
+			Fingerprint: fingerprint,
+			HasUsed:     true,
+		}, committer, committer, committer.Email); commitVerification != nil {
+			if commitVerification.Reason == asymkey_model.BadSignature {
+				defaultReason = asymkey_model.BadSignature
+			} else {
+				return commitVerification
+			}
+		}
+	}
+
+	defaultGPGSettings, err := c.GetRepositoryDefaultPublicGPGKey(false)
+	if defaultGPGSettings.Format == "ssh" {
+		if err != nil {
+			log.Error("Error getting default public gpg key: %v", err)
+		} else if defaultGPGSettings == nil {
+			log.Warn("Unable to get defaultGPGSettings for unattached commit: %s", c.ID.String())
+		} else if defaultGPGSettings.Sign {
+			if err := defaultGPGSettings.LoadPublicKeyContent(); err != nil {
+				log.Error("Error getting default signing key: %s %v", defaultGPGSettings.KeyID, err)
+			}
+			fingerprint, _ := asymkey_model.CalcFingerprint(defaultGPGSettings.PublicKeyContent)
+			if commitVerification := verifySSHCommitVerification(c.Signature.Signature, c.Signature.Payload, &asymkey_model.PublicKey{
+				Verified:    true,
+				Content:     defaultGPGSettings.PublicKeyContent,
+				Fingerprint: fingerprint,
+				HasUsed:     true,
+			}, committer, committer, committer.Email); commitVerification != nil {
+				if commitVerification.Reason == asymkey_model.BadSignature {
+					defaultReason = asymkey_model.BadSignature
+				} else {
+					return commitVerification
+				}
+			}
+		}
+	}
 
 	return &asymkey_model.CommitVerification{
 		CommittingUser: committer,
 		Verified:       false,
-		Reason:         asymkey_model.NoKeyFound,
+		Reason:         defaultReason,
 	}
 }