Gitea Merge Signing (and everything else)

January 18, 2022

I was trying to get Gitea to sign my initial commits, merges, and everything else not done directly by a user and ran into some frustration with the documentation. Here's how I solved it for my docker-compose setup, YMMV.

I created a git user on my machine, and passed through the .ssh directory as outlined [here].

su - git
gpg --generate-key

I kept getting permission denied errors when trying to finalize the key, apparently gpg will prompt you for a passphrase and the tty permissions do not allow it. I was able to run the commands inside of tmux, and everything worked just fine.

WARNING I skipped setting a passphrase because I wasn't sure how to make Gitea unlock the gpg key inside of docker. If anyone knows how to do this correctly, please let me know.

After I had the key, I needed to mount the .gnupg directory inside my docker container

version: "3"

services:
  server:
    image: gitea/gitea:latest
    environment:
      - USER_UID=1000
      - USER_GID=1000
    restart: unless-stopped
    volumes:
      - /opt/gitea/data:/data
      - /home/git/.ssh:/data/git/.ssh
      - /home/git/.gnupg:/data/git/.gnupg
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "127.0.0.1:3300:3000"
      - "127.0.0.1:2222:22"

After all that was set, I needed to edit my app.ini file. (located in /opt/gitea/data/gitea/conf/app.ini on my local system).

[repository.signing]
SIGNING_KEY = X8A0091299678863B5A2CBF3E478FEC0EA152FE5
SIGNING_NAME = Some Name
SIGNING_EMAIL = [email protected]
INITIAL_COMMIT = always
CRUD_ACTIONS = pubkey, twofa, parentsigned
WIKI = never
MERGES = pubkey, twofa, basesigned, commitssigned

The signing key is the key id that you just generated. You can get the keyid by running gpg --list-keys. Put that key id into the SIGNING_KEY field, and then be sure to set SIGNING_NAME and SIGNING_EMAIL.

I restarted my docker containers, and voila, I had fully signed repos from initial commit, to all merged pull requests.