Keys should not verify revoked email addresses

[zeripath]

When adding gpg keys, if the identity has been revoked do not match it with email addresses.

Fix #6778

Signed-off-by: Andrew Thornton [email protected]

[codecov-commenter]

Codecov Report

Merging #12486 into master will increase coverage by 0.01%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##           master   #12486      +/-   ##
==========================================
+ Coverage   43.73%   43.75%   +0.01%     
==========================================
  Files         631      631              
  Lines       69871    69873       +2     
==========================================
+ Hits        30560    30570      +10     
+ Misses      34352    34348       -4     
+ Partials     4959     4955       -4     

Impacted Files	Coverage Δ
models/gpg_key.go	54.58% <0.00%> (-0.22%)	⬇️
models/unit.go	45.07% <0.00%> (-2.82%)	⬇️
services/pull/pull.go	42.03% <0.00%> (+0.46%)	⬆️
modules/log/event.go	57.54% <0.00%> (+0.94%)	⬆️
modules/git/repo.go	50.25% <0.00%> (+1.01%)	⬆️
modules/indexer/stats/db.go	52.17% <0.00%> (+8.69%)	⬆️
modules/indexer/stats/queue.go	76.47% <0.00%> (+23.52%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ac3cfad...35942f0. Read the comment docs.

[zeripath]

I think we need to double check against what GH does for revoked IDs. There's an issue with the way GH uses git signatures here - it uses them as committer verification and therefore a signature matching a revoked email address is not necessarily incorrect.

---

Looks like this PR replicates this behaviour:

https://docs.github.com/en/github/authenticating-to-github/troubleshooting-commit-signature-verification

and is therefore correct.

[zeripath]

It's worth noting that this will only result in non-verification if and only if the key does not match any other email address for the user.

(Remember that Signature Verification in Gitea does not currently match Github - Github's signature verification is only committer verification we have a slightly different model.)