Implement http signatures support for the API #17565

42wim · 2021-11-06T00:26:33Z

This allows use to talk to the API with our ssh certificate (and/or ssh-agent) without needing to fetch an API key or tokens.
It will just automatically work when users have added their ssh principal in gitea.

This needs client code in tea
Update: also support normal pubkeys

ref: https://tools.ietf.org/html/draft-cavage-http-signatures

services/auth/httpsign.go

42wim · 2021-11-06T16:24:21Z

I've made PRs against go-sdk and tea:

lunny · 2021-11-07T03:03:20Z

Did Git supports the standard?

42wim · 2021-11-07T09:36:32Z

Did Git supports the standard?

no

42wim · 2021-11-11T20:32:05Z

Is this something that could still get in 1.16 ?

services/auth/httpsign.go

lunny · 2021-11-16T09:24:20Z

Is this something that could still get in 1.16 ?

I think we have feature freezed for v1.16 before this PR sent. I would like to put it into v1.17 .

codecov-commenter · 2021-12-04T13:25:13Z

Codecov Report

Merging #17565 (2870bc0) into main (6171ea7) will increase coverage by 0.05%.
The diff coverage is 46.28%.

@@            Coverage Diff             @@
##             main   #17565      +/-   ##
==========================================
+ Coverage   47.28%   47.33%   +0.05%     
==========================================
  Files         957      959       +2     
  Lines      133374   133628     +254     
==========================================
+ Hits        63067    63257     +190     
- Misses      62633    62673      +40     
- Partials     7674     7698      +24

Impacted Files	Coverage Δ
cmd/serv.go	`2.32% <0.00%> (-0.02%)`	⬇️
modules/context/repo.go	`51.42% <0.00%> (ø)`
modules/markup/external/external.go	`1.31% <0.00%> (-0.04%)`	⬇️
modules/setting/repository.go	`55.71% <ø> (ø)`
routers/api/v1/repo/release_attachment.go	`0.00% <0.00%> (ø)`
routers/install/install.go	`1.77% <0.00%> (-0.01%)`	⬇️
services/mailer/mailer.go	`29.79% <0.00%> (-0.25%)`	⬇️
services/mirror/mirror_pull.go	`27.65% <0.00%> (ø)`
services/repository/push.go	`51.83% <0.00%> (ø)`
routers/api/v1/repo/file.go	`69.76% <36.36%> (-6.87%)`	⬇️
... and 40 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update df9612b...2870bc0. Read the comment docs.

Fixes go-gitea#12338

services/auth/httpsign.go

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

lunny · 2022-02-13T13:49:37Z

I'm afraid this may result in a performance problem like we encountered in token ?

42wim · 2022-02-13T13:55:07Z

I'm afraid this may result in a performance problem like we encountered in token ?

Can you give some more context ?
If the signature header doesn't exist there is no performance impact on the API, no further checks or verification is done.

services/auth/httpsign.go

lunny · 2022-06-03T03:44:23Z

@42wim Good work for that. But just like @6543 said, I think tests are needed. I think it's not difficult to add some tests in integrations test.

42wim · 2022-06-03T22:34:49Z

@lunny remarks fixed and integration tests added

integrations/api_httpsig_test.go

lunny · 2022-06-04T03:06:42Z

CI failure is related.

42wim · 2022-06-04T15:24:40Z

latest CI failure seems to be a CI issue

zeripath · 2022-06-04T16:00:21Z

I'm gonna ignore this CI failure pass but if we see it a few times in other PRs and this one again I think we need to go hunt if there is a potential deadlock...

Hmm... it also happened on

https://drone.gitea.io/go-gitea/gitea/55674/2/15 - here was in code.gitea.io/gitea/modules/markup.render
https://drone.gitea.io/go-gitea/gitea/55672/2/15 - here was in github.com/go-testfixtures/testfixtures/v3.(*mySQL).resetSequences

I guess I can still ignore...

lunny · 2022-06-04T16:15:48Z

But yesterday, it's right https://drone.gitea.io/go-gitea/gitea/55639 for the same PR

42wim · 2022-06-04T18:21:01Z

Failed again, but seems to happen in other recent drone builds too.

lunny · 2022-06-05T03:10:33Z

Failed again, but seems to happen in other recent drone builds too.

#19887

zeripath · 2022-06-05T07:13:42Z

Make lgtm work

* giteaofficial/main: Add alt text to logo (go-gitea#19892) Limit max-height of CodeMirror editors for issue comment and wiki (go-gitea#18271) Implement http signatures support for the API (go-gitea#17565) Increment tests time out from 40m to 50m because sometimes the machine is slow (go-gitea#19887) fix(CI/CD): correct CI variable. (go-gitea#19886) Fix typo (go-gitea#19889) Fixing wrong paging when filtering on the issue dashboard (go-gitea#19801) Move `/info` outside authorization (go-gitea#19888) Fix order by parameter (go-gitea#19849) Exclude Archived repos from Dashboard Milestones (go-gitea#19882) use exact search instead of fuzzy search for branch filter dropdown (go-gitea#19885)

Fixes go-gitea#12338 This allows use to talk to the API with our ssh certificate (and/or ssh-agent) without needing to fetch an API key or tokens. It will just automatically work when users have added their ssh principal in gitea. This needs client code in tea Update: also support normal pubkeys ref: https://tools.ietf.org/html/draft-cavage-http-signatures Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: zeripath <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net>

42wim force-pushed the httpsign branch 3 times, most recently from 716659b to 90596a2 Compare November 6, 2021 00:40

lunny added the modifies/api This PR adds API routes or modifies them label Nov 6, 2021

lunny reviewed Nov 6, 2021

View reviewed changes

services/auth/httpsign.go Outdated Show resolved Hide resolved

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Nov 6, 2021

a1012112796 reviewed Nov 16, 2021

View reviewed changes

services/auth/httpsign.go Outdated Show resolved Hide resolved

lunny added this to the 1.17.0 milestone Dec 2, 2021

42wim added 5 commits January 15, 2022 18:59

Implement http signatures support for the API

4effd55

Fixes go-gitea#12338

Return nil on error

465a7f4

Add Failed authentication attempt warning

c8c344e

Fix upstream api changes to user_model

8612a72

Fix upstream api changes to asymkey_model

b0005d5

42wim force-pushed the httpsign branch from b896dce to b0005d5 Compare January 15, 2022 18:00

zeripath reviewed Jan 17, 2022

View reviewed changes

services/auth/httpsign.go Show resolved Hide resolved

lunny reviewed Feb 13, 2022

View reviewed changes

services/auth/httpsign.go Show resolved Hide resolved

lunny reviewed Feb 13, 2022

View reviewed changes

services/auth/httpsign.go Outdated Show resolved Hide resolved

lunny reviewed Feb 13, 2022

View reviewed changes

services/auth/httpsign.go Outdated Show resolved Hide resolved

lunny reviewed Feb 13, 2022

View reviewed changes

services/auth/httpsign.go Outdated Show resolved Hide resolved

42wim and others added 3 commits February 13, 2022 13:47

Merge branch 'main' into httpsign

8377c7f

Apply suggestions from code review

c86617b

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

Apply more suggestions from code review

0cf37bb

GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Jun 1, 2022

lunny reviewed Jun 3, 2022

View reviewed changes

services/auth/httpsign.go Outdated Show resolved Hide resolved

lunny reviewed Jun 3, 2022

View reviewed changes

services/auth/httpsign.go Outdated Show resolved Hide resolved

42wim added 2 commits June 4, 2022 00:30

Add code review changes

81365cf

Add integration tests for pub/privkey and certificate

6c00f75

lunny reviewed Jun 4, 2022

View reviewed changes

integrations/api_httpsig_test.go Show resolved Hide resolved

lunny reviewed Jun 4, 2022

View reviewed changes

integrations/api_httpsig_test.go Show resolved Hide resolved

42wim added 2 commits June 4, 2022 14:53

Add copyright and blank line

40da8bd

Add SSH_TRUSTED_USER_CA_KEYS to all database templates

b8d43cd

lunny approved these changes Jun 4, 2022

View reviewed changes

GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Jun 4, 2022

Merge branch 'main' into httpsign

2870bc0

Merge branch 'main' into httpsign

b723c85

Merge branch 'main' into httpsign

fa92d97

zeripath merged commit e528e2b into go-gitea:main Jun 5, 2022

ghost mentioned this pull request Jun 9, 2022

User keypairs and HTTP signatures for ActivityPub federation using go-ap #19133

Merged

1 task

go-gitea locked and limited conversation to collaborators May 3, 2023

Uh oh!

Implement http signatures support for the API #17565

Implement http signatures support for the API #17565

Uh oh!

Conversation

42wim commented Nov 6, 2021 • edited by lunny Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

42wim commented Nov 6, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lunny commented Nov 7, 2021

Uh oh!

42wim commented Nov 7, 2021

Uh oh!

42wim commented Nov 11, 2021

Uh oh!

Uh oh!

lunny commented Nov 16, 2021

Uh oh!

codecov-commenter commented Dec 4, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lunny commented Feb 13, 2022

Uh oh!

42wim commented Feb 13, 2022

Uh oh!

Uh oh!

Uh oh!

lunny commented Jun 3, 2022

Uh oh!

42wim commented Jun 3, 2022

Uh oh!

Uh oh!

Uh oh!

lunny commented Jun 4, 2022

Uh oh!

42wim commented Jun 4, 2022

Uh oh!

zeripath commented Jun 4, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lunny commented Jun 4, 2022

Uh oh!

42wim commented Jun 4, 2022

Uh oh!

lunny commented Jun 5, 2022

Uh oh!

zeripath commented Jun 5, 2022

Uh oh!

Uh oh!

42wim commented Nov 6, 2021 •

edited by lunny

Loading

42wim commented Nov 6, 2021 •

edited

Loading

codecov-commenter commented Dec 4, 2021 •

edited

Loading

zeripath commented Jun 4, 2022 •

edited

Loading