Add options to gotwebd.conf which set SSH host key fingeprints to
be displayed beneath the clone URL.

In gotwebd.conf the clone URL is arbitrary, which means the admin needs to
be able to specify key fingerprints per clone-URL, rather than per server.
So, for now, ssh fingerprints must be set per repository. If this causes
too much copy-pasting we can introduce equivalent server-scope options later.

gotsysd will be able to make assumptions about how the server is set
up and generate appropriate gotwebd.conf stanzas automatically.
A patch for gotsysd will follow.

ok?

M  gotwebd/gotweb.c        |  21+  0-
M  gotwebd/gotwebd.conf.5  |  12+  0-
M  gotwebd/gotwebd.h       |   8+  0-
M  gotwebd/pages.tmpl      |  12+  0-
M  gotwebd/parse.y         |  70+  0-

5 files changed, 123 insertions(+), 0 deletions(-)

commit - 8e075c1ec8542ad827b525234bea2eba76a011ad
commit + 896f2e7025bdfa07698b31229ccfdd7de5984ba4
blob - f4dc9ee62c67b484e6013abf9d57672569a9f3b9
blob + 2dcdf486c002a5a2a948db88611b6912fc1de984
--- gotwebd/gotweb.c
+++ gotwebd/gotweb.c
@@ -1124,11 +1124,15 @@ gotweb_free_repo_commit(struct repo_commit *rc)
 static void
 gotweb_free_repo_dir(struct repo_dir *repo_dir)
 {
+	size_t i;
+
 	if (repo_dir != NULL) {
 		free(repo_dir->name);
 		free(repo_dir->owner);
 		free(repo_dir->description);
 		free(repo_dir->url);
+		for (i = 0; i < nitems(repo_dir->sshfp); i++)
+			free(repo_dir->sshfp[i]);
 		free(repo_dir->path);
 	}
 	free(repo_dir);
@@ -1708,6 +1712,23 @@ gotweb_load_got_path(struct repo_dir **rp, const char 
 		error = gotweb_get_clone_url(&repo_dir->url, srv,
 		    repo_dir->path, dirfd(dt));
 	}
+
+	if (srv->show_repo_cloneurl && repo) {
+		size_t i;
+
+		for (i = 0; i < nitems(repo->clone_url_hostkey); i++) {
+			if (repo->clone_url_hostkey[i][0] == '\0')
+				continue;
+
+			repo_dir->sshfp[i] = strdup(repo->clone_url_hostkey[i]);
+			if (repo_dir->sshfp[i] == NULL) {
+				error = got_error_from_errno("strdup");
+				goto err;
+			}
+		}
+
+	}
+
 err:
 	free(dir_test);
 	if (dt != NULL && closedir(dt) == EOF && error == NULL)
blob - dd2a181f36cae86843ad2bd1da24552cfd704f34
blob + 213c5b4be700f2eab0b7e9c32341ac7d848a4123
--- gotwebd/gotwebd.conf.5
+++ gotwebd/gotwebd.conf.5
@@ -497,6 +497,18 @@ then URLs stored in the repository's
 .Pa cloneurl
 file will be shown instead.
 This file may contain multiple URLs, one per line.
+.It Ic ssh_hostkey_ecdsa Ar string
+Set the server's SSH ECDSA host key fingerprint to be displayed beneath
+the clone URL.
+Should be set when the clone URL uses the SSH protocol.
+.It Ic ssh_hostkey_ed25519 Ar string
+Set the server's SSH ED25519 host key fingerprint to be displayed beneath
+the clone URL.
+Should be set when the clone URL uses the SSH protocol.
+.It Ic ssh_hostkey_rsa Ar string
+Set the server's SSH RSA host key fingerprint to be displayed beneath
+the clone URL.
+Should be set when the clone URL uses the SSH protocol.
 .It Ic description Ar string
 Sets the repository description shown on the repository listing page.
 The
blob - af216fb97464e9ca56a9e377fdd5fc49502ebd0f
blob + 69c2896f72735357062dc4f09af598567a4aa339
--- gotwebd/gotwebd.h
+++ gotwebd/gotwebd.h
@@ -54,7 +54,13 @@
 #define GOTWEBD_MAXPORT		 6
 #define GOTWEBD_NUMPROC		 3
 #define GOTWEBD_SOCK_FILENO	 3
+#define GOTWEBD_MAX_SSHFP	 64
 
+#define GOTWEBD_SSHFP_ECDSA	0
+#define GOTWEBD_SSHFP_ED25519	1
+#define GOTWEBD_SSHFP_RSA	2
+#define GOTWEBD_NUM_SSHFP	3
+
 #define PROC_MAX_INSTANCES	 32
 
 /* GOTWEB DEFAULTS */
@@ -206,6 +212,7 @@ struct repo_dir {
 	char			*owner;
 	char			*description;
 	char			*url;
+	char			*sshfp[GOTWEBD_NUM_SSHFP];
 	time_t			 age;
 	char			*path;
 };
@@ -398,6 +405,7 @@ struct gotwebd_repo {
 	char name[NAME_MAX];
 	char description[GOTWEBD_MAXDESCRSZ];
 	char clone_url[GOTWEBD_MAXCLONEURLSZ];
+	char clone_url_hostkey[GOTWEBD_NUM_SSHFP][GOTWEBD_MAX_SSHFP];
 
 	enum gotwebd_auth_config	auth_config;
 	struct gotwebd_access_rule_list access_rules;
blob - cebcb17ddb34bf214026aa7e215c0e0f358e0824
blob + e146964ba1ffd06404dc161bd891095107b8ecc8
--- gotwebd/pages.tmpl
+++ gotwebd/pages.tmpl
@@ -1133,7 +1133,19 @@ nextsep(char *s, char **t)
   {{ if srv->show_repo_cloneurl }}
     <dt>Clone URL:</dt>
     <dd><pre class="clone-url">{{ t->repo_dir->url }}</pre></dd>
+  {{ if t->repo_dir->sshfp[GOTWEBD_SSHFP_ECDSA] }}
+    <dt>ECDSA:</dt>
+    <dd><pre class="clone-url">{{ t->repo_dir->sshfp[GOTWEBD_SSHFP_ECDSA] }}</pre></dd>
   {{ end }}
+  {{ if t->repo_dir->sshfp[GOTWEBD_SSHFP_ED25519] }}
+    <dt>ED25519:</dt>
+    <dd><pre class="clone-url">{{ t->repo_dir->sshfp[GOTWEBD_SSHFP_ED25519] }}</pre></dd>
+  {{ end }}
+  {{ if t->repo_dir->sshfp[GOTWEBD_SSHFP_RSA] }}
+    <dt>RSA:</dt>
+    <dd><pre class="clone-url">{{ t->repo_dir->sshfp[GOTWEBD_SSHFP_RSA] }}</pre></dd>
+  {{ end }}
+  {{ end }}
 </dl>
 <div class="summary-briefs">
   {{ render gotweb_render_briefs(tp) }}
blob - 03821d0d02b8707a48377d243fee6f91c949727b
blob + 06d0fa8ac5221e0906bb1adb03a35e49c67c6f35
--- gotwebd/parse.y
+++ gotwebd/parse.y
@@ -157,6 +157,7 @@ mediatype_ok(const char *s)
 %token	ENABLE DISABLE INSECURE REPOSITORY REPOSITORIES PERMIT DENY HIDE
 %token	WEBSITE PATH BRANCH REPOS_URL_PATH DESCRIPTION
 %token	TYPES INCLUDE GOTWEBD_CONTROL
+%token	SSH_HOSTKEY_ECDSA SSH_HOSTKEY_ED25519 SSH_HOSTKEY_RSA
 
 %token	<v.string>	STRING
 %token	<v.number>	NUMBER
@@ -978,6 +979,72 @@ repoopts1	: DISABLE AUTHENTICATION {
 				YYERROR;
 			}
 		}
+		| SSH_HOSTKEY_ECDSA STRING {
+			int i = GOTWEBD_SSHFP_ECDSA;
+
+			if (*$2 == '\0') {
+				yyerror("ssh host key fingerprint cannot be "
+				    "an empty string");
+				free($2);
+				YYERROR;
+			}
+
+			if (strlcpy(new_repo->clone_url_hostkey[i], $2,
+			    sizeof(new_repo->clone_url_hostkey[i])) >=
+			    sizeof(new_repo->clone_url_hostkey[i])) {
+				yyerror("ssh host key fingerprint too long, "
+				    "exceeds " "%zd bytes: %s",
+				    sizeof(new_repo->clone_url_hostkey[i]), $2);
+				free($2);
+				YYERROR;
+			}
+
+			free($2);
+		}
+		| SSH_HOSTKEY_ED25519 STRING {
+			int i = GOTWEBD_SSHFP_ED25519;
+
+			if (*$2 == '\0') {
+				yyerror("ssh host key fingerprint cannot be "
+				    "an empty string");
+				free($2);
+				YYERROR;
+			}
+
+			if (strlcpy(new_repo->clone_url_hostkey[i], $2,
+			    sizeof(new_repo->clone_url_hostkey[i])) >=
+			    sizeof(new_repo->clone_url_hostkey[i])) {
+				yyerror("ssh host key fingerprint too long, "
+				    "exceeds " "%zd bytes: %s",
+				    sizeof(new_repo->clone_url_hostkey[i]), $2);
+				free($2);
+				YYERROR;
+			}
+
+			free($2);
+		}
+		| SSH_HOSTKEY_RSA STRING {
+			int i = GOTWEBD_SSHFP_RSA;
+
+			if (*$2 == '\0') {
+				yyerror("ssh host key fingerprint cannot be "
+				    "an empty string");
+				free($2);
+				YYERROR;
+			}
+
+			if (strlcpy(new_repo->clone_url_hostkey[i], $2,
+			    sizeof(new_repo->clone_url_hostkey[i])) >=
+			    sizeof(new_repo->clone_url_hostkey[i])) {
+				yyerror("ssh host key fingerprint too long, "
+				    "exceeds " "%zd bytes: %s",
+				    sizeof(new_repo->clone_url_hostkey[i]), $2);
+				free($2);
+				YYERROR;
+			}
+
+			free($2);
+		}
 		;
 
 types		: TYPES	'{' optnl mediaopts_l '}'
@@ -1129,6 +1196,9 @@ lookup(char *s)
 		{ "site_name",			SITE_NAME },
 		{ "site_owner",			SITE_OWNER },
 		{ "socket",			SOCKET },
+		{ "ssh_hostkey_ecdsa",		SSH_HOSTKEY_ECDSA},
+		{ "ssh_hostkey_ed25519",	SSH_HOSTKEY_ED25519},
+		{ "ssh_hostkey_rsa",		SSH_HOSTKEY_RSA},
 		{ "summary_commits_display",	SUMMARY_COMMITS_DISPLAY },
 		{ "summary_tags_display",	SUMMARY_TAGS_DISPLAY },
 		{ "types",			TYPES },