Retry SSH key verification with additional CRLF if it failed (go-gite…

…a#28392) Windows-based shells will add a CRLF when piping the token into ssh-keygen command resulting in verification error. This resolves go-gitea#21527. --------- Co-authored-by: Heiko Besemann <[email protected]> Co-authored-by: wxiaoguang <[email protected]>
silverwind · Feb 20, 2024 · d81cc15 · d81cc15
1 parent 6cdf96a
commit d81cc15
Showing 1 changed file with 9 additions and 4 deletions.
diff --git a/models/asymkey/ssh_key_verify.go b/models/asymkey/ssh_key_verify.go
@@ -30,10 +30,15 @@ func VerifySSHKey(ctx context.Context, ownerID int64, fingerprint, token, signat
 		return "", ErrKeyNotExist{}
 	}
 
-	if err := sshsig.Verify(bytes.NewBuffer([]byte(token)), []byte(signature), []byte(key.Content), "gitea"); err != nil {
-		log.Error("Unable to validate token signature. Error: %v", err)
-		return "", ErrSSHInvalidTokenSignature{
-			Fingerprint: key.Fingerprint,
+	err = sshsig.Verify(bytes.NewBuffer([]byte(token)), []byte(signature), []byte(key.Content), "gitea")
+	if err != nil {
+		// edge case for Windows based shells that will add CR LF if piped to ssh-keygen command
+		// see https://github.com/PowerShell/PowerShell/issues/5974
+		if sshsig.Verify(bytes.NewBuffer([]byte(token+"\r\n")), []byte(signature), []byte(key.Content), "gitea") != nil {
+			log.Error("Unable to validate token signature. Error: %v", err)
+			return "", ErrSSHInvalidTokenSignature{
+				Fingerprint: key.Fingerprint,
+			}
 		}
 	}