jojo/templates/user/settings/keys_ssh.tmpl
0ko 1ef5496055 feat: use AppDomain for key verification (#10429)
Fixes #10416
Followup to a hardcoded string in [gitea#17743](https://github.com/go-gitea/gitea/pull/17743)

* instead of using a hardcoded namespace, use the configured application domain
    * `ssh-keygen` refuses to work with empty namespace, but `Domain` falls back to `localhost`:
    95dca7ff57/modules/setting/server.go (L192)
    * since `VerifySSHKey` verifies the namespace, I think that using a mostly-unique string instead of a hardcoded one doesn't hurt. Here's what `man ssh-keygen` says on the topic:
      > An additional signature namespace, used to prevent signature confusion across different domains of use (e.g. file signing vs email signing) must be provided  via  the  -n  flag.   Namespaces  are  arbitrary strings,  and  may  include:  “file”  for file signing, “email” for email signing.  For custom uses, it is recommended to use
names following a NAMESPACE@YOUR.DOMAIN pattern to generate unambiguous namespaces.

## Testing

There's a test `TestFromOpenSSH` but it uses a hardcoded default namespace `file`:
95dca7ff57/models/asymkey/ssh_key_test.go (L334)

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/10429
Reviewed-by: Beowulf <beowulf@beocode.eu>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Co-committed-by: 0ko <0ko@noreply.codeberg.org>
2025-12-17 17:01:14 +01:00

124 lines
6.2 KiB
Go HTML Template

<h4 class="ui top attached header">
{{ctx.Locale.Tr "settings.manage_ssh_keys"}}
<div class="ui right">
<button id="add-ssh-button" class="ui primary tiny show-panel toggle button" data-panel="#add-ssh-key-panel">
{{ctx.Locale.Tr "settings.add_key"}}
</button>
</div>
</h4>
<div class="ui attached segment">
<div class="{{if not .HasSSHError}}tw-hidden{{end}} tw-mb-4" id="add-ssh-key-panel">
<form class="ui form" action="{{.Link}}" method="post">
<div class="field {{if .Err_Title}}error{{end}}">
<label for="ssh-key-title">{{ctx.Locale.Tr "settings.key_name"}}</label>
<input id="ssh-key-title" name="title" value="{{.title}}" autofocus required maxlength="50">
</div>
<div class="field {{if .Err_Content}}error{{end}}">
<label for="ssh-key-content">{{ctx.Locale.Tr "settings.key_content"}}</label>
<textarea id="ssh-key-content" name="content" class="js-quick-submit" placeholder="{{ctx.Locale.Tr "settings.key_content_ssh_placeholder"}}" required>{{.content}}</textarea>
</div>
<input name="type" type="hidden" value="ssh">
<button class="ui primary button">
{{ctx.Locale.Tr "settings.add_key"}}
</button>
<button id="cancel-ssh-button" class="ui hide-panel button" data-panel="#add-ssh-key-panel">
{{ctx.Locale.Tr "cancel"}}
</button>
</form>
</div>
<div id="keys-ssh" class="flex-list">
<div class="flex-item">
<p>
{{ctx.Locale.Tr "settings.ssh_desc"}}<br>
{{ctx.Locale.Tr "settings.ssh_helper" "https://docs.codeberg.org/security/ssh-key/" "https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/troubleshooting-ssh"}}
</p>
</div>
{{if .DisableSSH}}
<div class="flex-item">
{{ctx.Locale.Tr "settings.ssh_signonly"}}
</div>
{{end}}
{{range $index, $key := .Keys}}
<div class="flex-item">
<div class="flex-item-leading">
<span class="text {{if .HasRecentActivity}}green{{end}}" {{if .HasRecentActivity}}data-tooltip-content="{{ctx.Locale.Tr "settings.key_state_desc"}}"{{end}}>{{svg "octicon-key" 32}}</span>
</div>
<div class="flex-item-main">
{{if .Verified}}
<div class="flex-item-title flex-text-block" data-tooltip-content="{{ctx.Locale.Tr "settings.ssh_key_verified_long"}}">{{svg "octicon-verified"}}{{ctx.Locale.Tr "settings.ssh_key_verified"}}</div>
{{end}}
<div class="flex-item-title">{{.Name}}</div>
<div class="flex-item-body">
{{.Fingerprint}}
</div>
<div class="flex-item-body">
<p>{{ctx.Locale.Tr "settings.added_on" (DateUtils.AbsoluteShort .CreatedUnix)}}{{svg "octicon-info"}} {{if .HasUsed}}{{ctx.Locale.Tr "settings.last_used"}} <span {{if .HasRecentActivity}}class="text green"{{end}}>{{DateUtils.AbsoluteShort .UpdatedUnix}}</span>{{else}}{{ctx.Locale.Tr "settings.no_activity"}}{{end}}</p>
</div>
</div>
<div class="flex-item-trailing">
<button class="ui red tiny button delete-button{{if index $.ExternalKeys $index}} disabled{{end}}" data-modal-id="delete-ssh" data-url="{{$.Link}}/delete?type=ssh" data-id="{{.ID}}"{{if index $.ExternalKeys $index}} title="{{ctx.Locale.Tr "settings.ssh_externally_managed"}}"{{end}}>
{{ctx.Locale.Tr "settings.delete_key"}}
</button>
{{if and (not .Verified) (ne $.VerifyingFingerprint .Fingerprint)}}
<a class="ui primary tiny button" href="?verify_ssh={{.Fingerprint}}">{{ctx.Locale.Tr "settings.ssh_key_verify"}}</a>
{{end}}
</div>
</div>
{{if and (not .Verified) (eq $.VerifyingFingerprint .Fingerprint)}}
<div class="ui segment">
<h4>{{ctx.Locale.Tr "settings.ssh_token_required"}}</h4>
<form class="ui form{{if $.HasSSHVerifyError}} error{{end}}" action="{{$.Link}}" method="post">
<input type="hidden" name="title" value="none">
<input type="hidden" name="content" value="{{.Content}}">
<input type="hidden" name="fingerprint" value="{{.Fingerprint}}">
<div class="field">
<label for="token">{{ctx.Locale.Tr "settings.ssh_token"}}</label>
<input readonly="" value="{{$.TokenToSign}}">
<span class="help">{{ctx.Locale.Tr "keys.verify.token.hint" (printf "?verify_ssh=%s" .Fingerprint)}}</span>
<div class="help">
<br>
<p>{{ctx.Locale.Tr "settings.ssh_token_help"}}</p>
<div class="markup"><pre class="code-block"><code>echo -n '{{$.TokenToSign}}' | ssh-keygen -Y sign -n {{AppDomain}} -f ~/.ssh/id_ed25519 # or the path to the private key if it is different.</code></pre></div>
<br>
<p>{{ctx.Locale.Tr "settings.ssh_token_help_ssh_agent"}}</p>
<div class="markup"><pre class="code-block"><code>bash -c "echo -n '{{$.TokenToSign}}' | ssh-keygen -Y sign -n {{AppDomain}} -f <(echo '{{.OmitEmail}}')"</code></pre></div>
<br>
<details>
<summary>Windows PowerShell</summary>
<div class="markup"><pre class="code-block"><code>cmd /c "&lt;NUL set /p=`"{{$.TokenToSign}}`"| ssh-keygen -Y sign -n {{AppDomain}} -f /path_to_PrivateKey_or_RelatedPublicKey"</code></pre></div>
</details>
<br>
<details>
<summary>Windows CMD</summary>
<div class="markup"><pre class="code-block"><code>&lt;NUL set /p="{{$.TokenToSign}}"| ssh-keygen -Y sign -n {{AppDomain}} -f /path_to_PrivateKey_or_RelatedPublicKey</code></pre></div>
</details>
</div>
<br>
</div>
<div class="field">
<label for="signature">{{ctx.Locale.Tr "settings.ssh_token_signature"}}</label>
<textarea id="ssh-key-signature" name="signature" class="js-quick-submit" placeholder="{{ctx.Locale.Tr "settings.key_signature_ssh_placeholder"}}" required>{{$.signature}}</textarea>
</div>
<input name="type" type="hidden" value="verify_ssh">
<button class="ui primary button">
{{ctx.Locale.Tr "settings.ssh_key_verify"}}
</button>
<a class="ui red button" href="{{$.Link}}">
{{ctx.Locale.Tr "settings.cancel"}}
</a>
</form>
</div>
{{end}}
{{end}}
</div>
<div class="ui g-modal-confirm delete modal" id="delete-ssh">
<div class="header">
{{svg "octicon-trash"}}
{{ctx.Locale.Tr "settings.ssh_key_deletion"}}
</div>
<div class="content">
<p>{{ctx.Locale.Tr "settings.ssh_key_deletion_desc"}}</p>
</div>
{{template "base/modal_actions_confirm" .}}
</div>
</div>