Allow configuring a system gpg key #107

New Issue

viceice · 2021-02-01T12:25:41Z

viceice commented

2021-02-01 12:25:41 +00:00

It would be nice if there is a possibility to add and configure a gpg key to use the gitea gpg signing feature

👍 1

justusbunsi commented

2021-06-18 16:50:13 +00:00

Hi. IMO, this could be a great addition to the chart. After playing around with the configuration it would require several inputs:

private gpg key (for importing into the system)
<keyid> to be used as reference in configuration
username + email (either for .gitconfig or app.ini)
SIGNING_KEY mode (default or the keyid)

With that gpg key pair we would be able to generate a valid gpg file structure that could be injected into the container. Not sure what this would mean from a security perspective.
Depending on the specified SIGNING_KEY mode, the chart would either need to modify the .gitconfig or add the necessary environment variables so that env-to-ini can take care of them during app.ini creation.

Since the private key is highly valuable it wouldn't be wise to allow an inline configuration at values.yaml. Means, Kubernetes secret for these inputs, mounted into an initcontainer (and only into that) for creating the required gpg files. And referring to that secret in values.yaml.

EDIT: I've removed the "public key" references as it isn't required for that.

Hi. IMO, this could be a great addition to the chart. After playing around with the configuration it would require several inputs: - private gpg key (for importing into the system) - `<keyid>` to be used as reference in configuration - username + email (either for `.gitconfig` or `app.ini`) - `SIGNING_KEY` mode (default or the keyid) With that gpg key pair we would be able to generate a valid gpg file structure that could be injected into the container. Not sure what this would mean from a security perspective. Depending on the specified `SIGNING_KEY` mode, the chart would either need to modify the `.gitconfig` or add the necessary environment variables so that env-to-ini can take care of them during app.ini creation. Since the private key is highly valuable it wouldn't be wise to allow an inline configuration at `values.yaml`. Means, Kubernetes secret for these inputs, mounted into an initcontainer (and only into that) for creating the required gpg files. And referring to that secret in `values.yaml`. EDIT: I've removed the "public key" references as it isn't required for that.

justusbunsi added the

kind

feature

label 2021-06-26 11:24:14 +00:00

viceice commented

2021-11-23 14:49:12 +00:00

This is partially solved by #186.
It now needs only manual import of the private key to git and the Gitea signing options.

This is partially solved by #186. It now needs only manual import of the private key to git and the Gitea signing options.

justusbunsi commented

2021-11-24 12:15:49 +00:00

Good catch. Missed that. ?
And with the upcoming pull requests regarding sensitive data injection to the app.ini it will be much more secure to define. Then it would just be the gpg store init.

Good catch. Missed that. ? And with the upcoming pull requests regarding sensitive data injection to the app.ini it will be much more secure to define. Then it would just be the gpg store init.

justusbunsi referenced a pull request that will close this issue

2022-08-04 15:46:30 +00:00

Add gpg configuration settings #343

justusbunsi referenced this issue

2022-08-15 11:24:42 +00:00

Update app version to 1.17.0 #340

pat-s closed this issue

2022-09-28 08:19:00 +00:00

pat-s referenced this issue from a commit

2022-09-28 08:19:00 +00:00

Add gpg configuration settings (#343)

viceice commented

2023-01-04 15:23:02 +00:00

Reopen this because #343 got reverted in #373 by @justusbunsi.

@pat-s Can you please create a new PR with those changes again? ❤️

Reopen this because #343 got reverted in #373 by @justusbunsi. @pat-s Can you please create a new PR with those changes again? :heart:

viceice reopened this issue

2023-01-04 15:23:08 +00:00

justusbunsi commented

2023-01-04 15:35:12 +00:00

@viceice

Reopen this because #343 got reverted in #373 by @justusbunsi.

@pat-s Can you please create a new PR with those changes again? ❤️

There is #374 to add it again. It was removed to tag without breaking changes.

@viceice >Reopen this because #343 got reverted in #373 by @justusbunsi. > >@pat-s Can you please create a new PR with those changes again? :heart: There is #374 to add it again. It was removed to tag without breaking changes.

👍 1 ❤️ 1

justusbunsi commented

2023-01-04 15:37:31 +00:00

I just realized that there are conflicts in the mentioned PR. ? Have to resolve them.

justusbunsi referenced a pull request that will close this issue

2023-01-14 12:39:42 +00:00

Re-add GPG configuration feature #374

justusbunsi closed this issue

2023-01-17 16:58:11 +00:00

justusbunsi referenced this issue from a commit

2023-01-17 16:58:12 +00:00

Re-add GPG configuration feature (#374)

viceice commented

2023-03-07 12:23:36 +00:00

I've disabled chart singing and use manual GNUPGHOME/data/git/.gnupg for now.

Need to think how the best way to publish the key to a secret via terraform.
Must be working via automated CI (currently github-actions). ?

I've disabled chart singing and use manual `GNUPGHOME/data/git/.gnupg` for now. Need to think how the best way to publish the key to a secret via terraform. Must be working via automated CI (currently github-actions). ?

justusbunsi commented

2023-03-07 15:31:36 +00:00

I've disabled chart singing and use manual GNUPGHOME/data/git/.gnupg for now.

The setup is possible with Chart version 7.0.0. No need for manual mapping anymore. ?

> I've disabled chart singing and use manual `GNUPGHOME/data/git/.gnupg` for now. The setup is possible with Chart version 7.0.0. No need for manual mapping anymore. ?

viceice commented

2023-03-21 05:32:12 +00:00

I've disabled chart singing and use manual GNUPGHOME/data/git/.gnupg for now.

The setup is possible with Chart version 7.0.0. No need for manual mapping anymore. ?

I know, but my gpg key isn't yet available to my terraform config, which is deploying the gitea helm chart. So i need to fix that first. ?

> > I've disabled chart singing and use manual `GNUPGHOME/data/git/.gnupg` for now. > > The setup is possible with Chart version 7.0.0. No need for manual mapping anymore. ? I know, but my gpg key isn't yet available to my terraform config, which is deploying the gitea helm chart. So i need to fix that first. ?

👍 1

Sign in to join this conversation.

No Milestone

No Assignees

2 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: gitea/helm-chart#107