Crea un profiloAccedi

Ricerche recenti

Nessuna ricerca recente

Opzioni di ricerca

Disponibile solo dopo aver effettuato l'accesso.
mastodon.uno è uno dei tanti server Mastodon indipendenti che puoi usare per partecipare al fediverso.
Mastodon.Uno è la principale comunità mastodon italiana. Con 77.000 iscritti è il più grande nodo Mastodon italiano: anima ambientalista a supporto della privacy e del mondo Open Source.

Amministrato da:

Statistiche del server:

6,5K
utenti attivi

mastodon.uno: InfoStatoCartella dei profiliPolitica sulla privacy

Mastodon: InfoScarica l'appScorciatoie da tastieraVisualizza il codice sorgentev4.3.7

#gitlab

18 post18 partecipanti1 post oggi
Pubblico
Gea-Suan Lin

GitLab 的字型：GitLab Sans 與 GitLab Mono

前幾天翻資料的時候看到的字型：「GitLab Fonts」，找了一下在 2023 年年出的時候就發表了：「Get to know the new GitLab typefaces」。 其中 GitLab Sans 的部分是改自 Inter： This font is based on Inter (version 4), but with a few adjustments[.] 而 GitLab Mono 則是改自 JetBrains Mono： This font is based on JetBrains Mono, but with a few adjustments. 裡面把 ligature 關掉算是我還蠻喜歡的方向，選用的兩個字型我也還算喜歡，換上去用看看…

blog.gslin.org/archives/2025/0

Gea-Suan Lin's BLOG · GitLab 的字型：GitLab Sans 與 GitLab Mono前幾天翻資料的時候看到的字型：「GitLab Fonts」，找了一下在 2023 年年出的時候就發表了：「Get to know the new GitLab typefaces」。 其中 GitLab Sans 的部分是改自 Inter： This font is based on Inter (version 4), but with a few adjustments 而 GitLab Mono 則...
#font#fonts#gitlab
Pubblico
Sheogorath

Finally merged my #Tekton experiment.

Added 34000 lines of YAML to drop 62. Not the best ratio 😅

But let's see where things go from here. I'm quite confident that I'll be able to replace gitlab-runners in the next few weeks and find a good pattern for the pipelines.

But I think I'll take a day off working on these. It's so crazy abstract, but that's also the potential tekton holds.

git.shivering-isles.com/shiver

GitLabfeat(tekton): Deploy to cluster (ee0d4e8e) · Commits · Shivering-Isles / Infrastructure GitOps · GitLabThis patch introduces Tekton pipelines and Tekton triggers to the cluster. This should provide a new, independent way to run pipelines across various git forges. It's a preparation of changing...
#kubernetes#gitlab
Pubblico *
Scott Williams 🐧

Tried to login to #Gitlab today. The OTP code they sent to my email (which landed in Spam) didn't work and further login attempts, the code never arrived and now my account is locked, even if logging in through GitHub, etc, and the login page for their Zendesk also doesn't load for me to submit a ticket, so that's fun. I'm remembering again why I opted for deploying #Forgejo over it.

Pubblico *
Janik :linux: :ansible: :bash:

Over the coming months I will move all my personal and private repositories from #GitHub and #GitLab to #Codeberg. I run many static sites and intend to use ci.codeberg.org to trigger the builds.

Once this process is finished and everything works fine with #forgejo. I will also migrate the repos of my company #MintSystem to codey.ch/. As there are some GitHub integrations I can't get rid of, I intend to mirror back the repos.

I'll keep you updated via #CodebergMigration.

ci.codeberg.orgWoodpecker
Pubblico *
Baa

The way Gitlab, Forgejo, Gitea etc. use the server-side SSH server to accept pushed data over SSH relies on a system user called git having SSH access. (or forgejo in their case).

Access is granted by the standard authorized_keys inside ~/.ssh, which for forgejo means /var/lib/forgejo/.ssh/authorized_keys. When a user adds an SSH key to their account, it's added to this authorized_keys file.

I really hate this, this means that any user of Forgejo is only inches away from having full shell access. The default shell of the forgejo user is /bin/bash, it exists inside of /etc/passwd:

forgejo:x:122:130:Forgejo (Beyond coding. We forge.):/var/lib/forgejo:/bin/bash
I really really hate this. The only thing preventing random users of Forgejo having shell access is the default command of the SSH session as stipulated by the authorized_keys entry, this is what it looks like:
command="/usr/bin/forgejo --config=/etc/forgejo/app.ini serv key-1",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,no-user-rc,restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOgnZeNC4fMCXYuWxir7NlKts9Zj4sYZZJzzHh4IyTm2 Baa-New

This is technically secure, there is no publicly known way of bypassing this and gaining shell access by adding your own SSH key to forge and SSHing into the server as the forgejo user. It will immediately disconnect you, and if you try submitting any specific command you'll receive Disallowed command.

But still, I really really really hate this. We're just one tiny misconfiguration, one minuscule exploit away from granting all forgejo users shell access into the server ​:akko_sob:​

Imagine for example, you were hosting a Minecraft server on Windows. And to grant a user access to it, you had to create them a Windows User inside control userpasswords2 and then explicitly disallow them RDP access. That RDP config is the only thing preventing them for remoting straight into your server. This si what it feels like, I can't help but wish SSH was entirely separate from everything else going on here.

Which is exactly what Forgejo's own built-in SSH server does, I'll enable that and move it to a different port, because I'm too scared otherwise, and my server's not even public, and I haven't even started with Runners yet, those scare me even more ​:02notlikethis:​

Feel free to correct me if I'm wrong, or add your own insights I'd like to know more about this mentality #ssh #git #forgejo #linux #security #gitlab
EsploraFeed dal vivo
Info