SSH Authentication Issues

[dosch]

Environment

• YunoHost Version: 12.1.15.1
• Forgejo Package Version: 12.0.1~ynh1
• Forgejo Application Version: 12.0.1+gitea-1.22.0

Summary

I've encountered some challenges with Git operations and wanted to share my findings in case they're helpful for improving the user experience. The web interface works beautifully, but I'm having trouble getting Git operations to work smoothly.

Issue 1: SSH Key Verification Challenges

I'm unable to complete the SSH key verification process, which prevents SSH-based Git operations from working.

Steps I've tried

1. Generated Ed25519 SSH key: ssh-keygen -t ed25519
2. Added the public key through Forgejo's web interface (key appears correctly with matching fingerprint)
3. Attempted verification using the provided token and command:

   echo -n '[token]' | ssh-keygen -Y sign -n gitea -f ~/.ssh/id_ed25519

4. Copied the generated signature to the verification form

Current behavior

The verification consistently returns: "The provided SSH key, signature or token do not match or token is out-of-date"

Technical details

• SSH connection to, in my case, port 2222 works correctly (server responds properly)
• Key fingerprints match between local and web interface
• SSH client debug shows the key is being offered but rejected by the server
• Multiple key types tested (Ed25519, RSA 4096-bit) with same result
• Git SSH operations completely non-functional:

  ssh -T git@git.MYDOMAIN.COM
  # Result: Permission denied (publickey)
  
  git clone git@git.MYDOMAIN.COM:USER/tjoeke.git
  # Result: Permission denied (publickey)

Thoughts on possible causes

Because the SSH key verification step fails, I'm unable to use any SSH-based Git commands:

• git clone git@domain.com:user/repo.git - fails with "Permission denied (publickey)"
• git push via SSH - same authentication failure
• ssh -T git@domain.com - authentication test fails

This suggests the verification step is a prerequisite for SSH keys to be recognized by the Git authentication system.

I wonder if this might be related to the integration between YunoHost's user management and Forgejo's SSH key system? Or perhaps there could be a timing issue with token validation? I'm not sure if the -n gitea parameter in the signature command should be something else for Forgejo installations.

Issue 2: HTTPS Authentication Behavior

What I've observed

HTTPS Git operations work well when the app is set to public mode (as documented), but redirect to SSO when in private mode.

Behavior details

Private Mode:

git push origin main
# Redirects to YunoHost SSO page instead of accepting Personal Access Token

Public Mode:

git push origin main
# Works perfectly with Personal Access Token

Understanding

I see from the documentation that this is the intended behavior ("Git command access with HTTPS: If you want to use the Git command, you need to set this app as public"). I'm curious if there might be a way to allow authenticated HTTPS operations in private mode in the future, as this could be helpful for users wanting private repositories with Git access.

Documentation and User Experience

What's working well

• The installation process is smooth
• Web interface functionality is excellent
• The existing documentation covers the key points

Areas where I got confused

• I initially expected SSH to work based on the documentation mentioning SSH configuration, but the verification step prevented this
• It took some trial and error to discover the public mode requirement for HTTPS

Suggestions

If it would be helpful, perhaps the documentation could include:

• A brief troubleshooting section for SSH key verification issues
• More prominent mention of the public mode requirement for Git operations
• Maybe some common error scenarios and their solutions

Impact on Workflow

Currently, I'm using HTTPS with public mode as a workaround, which works well for my use case. However, SSH-based Git operations are completely unavailable, which I imagine might be the preferred method for many users. Some users might also need private mode for their repositories but still want to use Git operations.

Questions for the Maintainer

• Is the SSH verification issue something you've encountered before?
• Would you like me to test anything specific to help debug this?
• Are there any logs I could check that might provide more insight?
• Is this potentially an upstream issue that should be reported to Forgejo as well?

I'm happy to help test any potential fixes or provide additional information if that would be useful.

[Thatoo]

I could verify my ssh key with this command :

bash -c "echo -n 'TOKEN' | ssh-keygen -Y sign -n FORGEJO_URL -f <(echo 'SSHPUBKEY')"

and then I could identify after running these commands :

git config user.email "USER_EMAIL"
git config user.name "USERNAME"
gpg --list-secret-keys --keyid-format=long
git config gpg.format ssh
git config user.signingkey /PATH/TO/SSH/KEY.pub
git config commit.gpgSign true
git remote set-url origin git+ssh://forgejo@FORGEJO_URL:SSHPORT/USERNAME/REPO_NAME.git

be carefull, it's git+ssh://forgejo@ and not git+ssh://git@ as with github...