mirrors/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo synced 2024-06-26 11:53:00 +02:00
Code Issues Packages Projects Releases Wiki Activity
17125 commits 24 branches 219 tags 949 MiB
Go 73.6%
go-html-template 11.5%
JavaScript 5.1%
Roff 5%
CSS 3.4%
Other 1.2%
Go to file
Gusted c73ac63696
[SECURITY] Rework long-term authentication 
- This is a 'front-port' of the already existing patch on v1.21 and
v1.20, but applied on top of what Gitea has done to rework the LTA
mechanism. Forgejo will stick with the reworked mechanism by the Forgejo
Security team for the time being. The removal of legacy code (AES-GCM) has been
left out.
- The current architecture is inherently insecure, because you can
construct the 'secret' cookie value with values that are available in
the database. Thus provides zero protection when a database is
dumped/leaked.
- This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies).
- Integration testing is added to ensure the new mechanism works.
- Removes a setting, because it's not used anymore.

(cherry picked from commit e3d6622a63)
(cherry picked from commit fef1a6dac5)
(cherry picked from commit b0c5165145)
(cherry picked from commit 7ad51b9f8d)
(cherry picked from commit 64f053f383)
(cherry picked from commit f5e78e4c20)

Conflicts:
	services/auth/auth_token_test.go
	https://codeberg.org/forgejo/forgejo/pulls/2069
(cherry picked from commit f69fc23d4b)
(cherry picked from commit d955ab3ab0)
(cherry picked from commit 9220088f90)
2024-01-22 13:41:21 +00:00
.devcontainer devpod use go1.21 (#26637) 2023-08-21 16:20:50 +00:00
.forgejo [CI] Forgejo Actions based CI for PR & branches (squash) install git >= 2.42 2024-01-22 12:42:44 +00:00
.gitea [WORKFLOW] yaml issue templates 2024-01-22 13:41:21 +00:00
assets Update go dependencies (#28518) 2023-12-19 09:18:42 +08:00
build Use Set[Type] instead of map[Type]bool/struct{}. (#26804) 2023-08-30 06:55:25 +00:00
cmd [CLI] implement forgejo-cli 2024-01-22 12:18:30 +00:00
contrib Suggest to use Type=simple for systemd service (#28717) 2024-01-07 15:18:04 +00:00
custom/conf [FEAT] Use OpenStreetMap in USER_LOCATION_MAP_URL by default 2024-01-22 13:41:20 +00:00
docker Dockerfile small refactor (#27757) 2023-10-29 09:44:06 +08:00
docs In administration documentation about environment variables, point to those for the Go runtime instead of Go compiler (#28859) 2024-01-20 10:12:20 +08:00
models [SECURITY] Rework long-term authentication 2024-01-22 13:41:21 +00:00
modules [SECURITY] Rework long-term authentication 2024-01-22 13:41:21 +00:00
options Add missing exclusive in advanced label options (#28322) 2024-01-22 07:56:17 +00:00
public [API] Forgejo API /api/forgejo/v1 2024-01-22 13:41:20 +00:00
releases/images [DOCS] RELEASE-NOTES.md 2024-01-22 13:41:20 +00:00
routers [SECURITY] Rework long-term authentication 2024-01-22 13:41:21 +00:00
services [SECURITY] Rework long-term authentication 2024-01-22 13:41:21 +00:00
snap set version in snapcraft yaml 2023-09-13 23:20:46 -04:00
templates [FEAT] allow setting the update date on issues and comments 2024-01-22 13:41:21 +00:00
tests [SECURITY] Rework long-term authentication 2024-01-22 13:41:21 +00:00
web_src [API] Forgejo API /api/forgejo/v1 2024-01-22 13:41:20 +00:00
.air.toml Reduce verbosity of dev commands (#24917) 2023-05-24 20:11:04 +00:00
.changelog.yml Adapt .changelog.yml to new labeling system (#27701) 2023-10-20 00:22:00 +02:00
.deadcode-out [SECURITY] Rework long-term authentication 2024-01-22 13:41:21 +00:00
.dockerignore Move public asset files to the proper directory (#25907) 2023-07-18 18:06:43 +02:00
.editorconfig
.eslintrc.yaml Update JS and PY dependencies (#28120) 2023-11-20 01:02:57 +01:00
.gitattributes [META] Use correct language for .tmpl 2024-01-22 13:41:20 +00:00
.gitignore [DEADCODE] Add deadcode linter 2024-01-22 13:41:21 +00:00
.gitpod.yml Add Github related extensions in devcontainer (#25800) 2023-07-14 15:58:02 +08:00
.golangci.yml Remove go versions from .golangci.yml (#27953) 2023-11-07 22:03:27 +01:00
.ignore Add /public/assets to .ignore (#26232) 2023-07-30 12:34:20 +02:00
.markdownlint.yaml Update JS dependencies (#28537) 2023-12-30 05:29:03 +00:00
.npmrc Upgrade to npm lockfile v3 and explicitely set it (#23561) 2023-03-18 19:38:10 +01:00
.spectral.yaml
.stylelintrc.yaml Update JS dependencies (#28537) 2023-12-30 05:29:03 +00:00
.yamllint.yaml fully replace drone with actions (#27556) 2023-10-11 06:39:32 +00:00
BSDmakefile Fix build errors on BSD (in BSDMakefile) (#27594) 2023-10-13 15:38:27 +00:00
build.go User/Org Feed render description as per web (#23887) 2023-04-04 04:39:47 +01:00
CHANGELOG.md Fix release link in changelog for v1.21.0 2023-11-14 15:03:49 +01:00
CODEOWNERS [META] Add CODEOWNERS files 2024-01-22 13:41:21 +00:00
CONTRIBUTING.md [DOCS] CONTRIBUTING 2024-01-22 13:41:20 +00:00
DCO Remove address from DCO (#22595) 2023-01-24 18:52:38 +00:00
Dockerfile [CI] Forgejo Actions based release process 2024-01-22 12:18:31 +00:00
Dockerfile.rootless [CI] Forgejo Actions based release process 2024-01-22 12:18:31 +00:00
go.mod Set the isPermaLink attribute to false in the guid sub-element (#28860) 2024-01-20 02:38:16 +00:00
go.sum Set the isPermaLink attribute to false in the guid sub-element (#28860) 2024-01-20 02:38:16 +00:00
LICENSE [DOCS] LICENSE: add Forgejo Authors 2024-01-22 13:41:20 +00:00
main.go [SEMVER] store SemVer in ForgejoSemVer after a database upgrade 2024-01-22 13:41:20 +00:00
MAINTAINERS Apply to become a maintainer (#27522) 2023-10-08 10:36:40 -04:00
Makefile [CLEANUP] Reuse ForgejoVersion variable 2024-01-22 13:41:21 +00:00
package-lock.json Revert adding htmx until we finaly decide to add it (#28879) 2024-01-21 21:42:35 +08:00
package.json Revert adding htmx until we finaly decide to add it (#28879) 2024-01-21 21:42:35 +08:00
playwright.config.js Update JS dependencies and eslint config (#21388) 2022-10-10 20:02:20 +08:00
poetry.lock Update JS and PY dependencies (#28120) 2023-11-20 01:02:57 +01:00
poetry.toml Clean up pyproject.toml and package.json, fix poetry options (#25327) 2023-06-18 18:13:08 +00:00
pyproject.toml Update JS and PY dependencies (#28120) 2023-11-20 01:02:57 +01:00
README.md [DOCS] README 2024-01-22 13:41:20 +00:00
RELEASE-NOTES.md [DOCS] RELEASE-NOTES.md 2024-01-22 13:41:20 +00:00
vitest.config.js Use vitest globals (#27102) 2023-09-27 04:37:13 +00:00
webpack.config.js [API] Forgejo API /api/forgejo/v1 2024-01-22 13:41:20 +00:00

README.md

Welcome to Forgejo

Hi there! Tired of big platforms playing monopoly? Providing Git hosting for your project, friends, company or community? Forgejo (/for'd͡ʒe.jo/ inspired by forĝejo – the Esperanto word for forge) has you covered with its intuitive interface, light and easy hosting and a lot of builtin functionality.

Forgejo was created in 2022 because we think that the project should be owned by an independent community. If you second that, then Forgejo is for you! Our promise: Independent Free/Libre Software forever!

What does Forgejo offer?

If you like any of the following, Forgejo is literally meant for you:

  • Lightweight: Forgejo can easily be hosted on nearly every machine. Running on a Raspberry? Small cloud instance? No problem!
  • Project management: Besides Git hosting, Forgejo offers issues, pull requests, wikis, kanban boards and much more to coordinate with your team.
  • Publishing: Have something to share? Use releases to host your software for download, or use the package registry to publish it for docker, npm and many other package managers.
  • Customizable: Want to change your look? Change some settings? There are many config switches to make Forgejo work exactly like you want.
  • Powerful: Organizations & team permissions, CI integration, Code Search, LDAP, OAuth and much more. If you have advanced needs, Forgejo has you covered.
  • Privacy: From update checker to default settings: Forgejo is built to be privacy first for you and your crew.
  • Federation: (WIP) We are actively working to connect software forges with each other through ActivityPub, and create a collaborative network of personal instances.

Learn more

Dive into the documentation, subscribe to releases and blog post on our website, find us on the Fediverse or hop into our Matrix room if you have any questions or want to get involved.

Get involved

If you are interested in making Forgejo better, either by reporting a bug or by changing the governance, please take a look at the contribution guide.