mirror of
https://codeberg.org/davrot/forgejo.git
synced 2025-05-28 21:00:03 +02:00
Backport #20299. Follow #20298. Only the `GlobalInitInstalled` function should prepare the SSH files for external server or starts the builtin server. * `trustedUserCaKeys` is removed, use `SSH.TrustedUserCAKeys` directly * introduce `ssh.Init`, move the SSH init code from `routers/init.go` to it * `ssh.Init` will start builtin SSH server or prepare external SSH server files
This commit is contained in:
parent
c556a83c35
commit
54ef658861
4 changed files with 63 additions and 29 deletions
|
@ -843,8 +843,9 @@ func loadFromConf(allowEmpty bool, extraConfig string) {
|
|||
SSH.StartBuiltinServer = false
|
||||
}
|
||||
|
||||
trustedUserCaKeys := sec.Key("SSH_TRUSTED_USER_CA_KEYS").Strings(",")
|
||||
for _, caKey := range trustedUserCaKeys {
|
||||
SSH.TrustedUserCAKeysFile = sec.Key("SSH_TRUSTED_USER_CA_KEYS_FILENAME").MustString(filepath.Join(SSH.RootPath, "gitea-trusted-user-ca-keys.pem"))
|
||||
|
||||
for _, caKey := range SSH.TrustedUserCAKeys {
|
||||
pubKey, _, _, _, err := gossh.ParseAuthorizedKey([]byte(caKey))
|
||||
if err != nil {
|
||||
log.Fatal("Failed to parse TrustedUserCaKeys: %s %v", caKey, err)
|
||||
|
@ -852,7 +853,7 @@ func loadFromConf(allowEmpty bool, extraConfig string) {
|
|||
|
||||
SSH.TrustedUserCAKeysParsed = append(SSH.TrustedUserCAKeysParsed, pubKey)
|
||||
}
|
||||
if len(trustedUserCaKeys) > 0 {
|
||||
if len(SSH.TrustedUserCAKeys) > 0 {
|
||||
// Set the default as email,username otherwise we can leave it empty
|
||||
sec.Key("SSH_AUTHORIZED_PRINCIPALS_ALLOW").MustString("username,email")
|
||||
} else {
|
||||
|
@ -861,20 +862,6 @@ func loadFromConf(allowEmpty bool, extraConfig string) {
|
|||
|
||||
SSH.AuthorizedPrincipalsAllow, SSH.AuthorizedPrincipalsEnabled = parseAuthorizedPrincipalsAllow(sec.Key("SSH_AUTHORIZED_PRINCIPALS_ALLOW").Strings(","))
|
||||
|
||||
if !SSH.Disabled && !SSH.StartBuiltinServer {
|
||||
if err = os.MkdirAll(SSH.KeyTestPath, 0o644); err != nil {
|
||||
log.Fatal("Failed to create '%s': %v", SSH.KeyTestPath, err)
|
||||
}
|
||||
|
||||
if len(trustedUserCaKeys) > 0 && SSH.AuthorizedPrincipalsEnabled {
|
||||
fname := sec.Key("SSH_TRUSTED_USER_CA_KEYS_FILENAME").MustString(filepath.Join(SSH.RootPath, "gitea-trusted-user-ca-keys.pem"))
|
||||
if err := os.WriteFile(fname,
|
||||
[]byte(strings.Join(trustedUserCaKeys, "\n")), 0o600); err != nil {
|
||||
log.Fatal("Failed to create '%s': %v", fname, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
SSH.MinimumKeySizeCheck = sec.Key("MINIMUM_KEY_SIZE_CHECK").MustBool(SSH.MinimumKeySizeCheck)
|
||||
minimumKeySizes := Cfg.Section("ssh.minimum_key_sizes").Keys()
|
||||
for _, key := range minimumKeySizes {
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue