No description
  • Go 93.2%
  • HCL 5.9%
  • Shell 0.5%
  • Makefile 0.4%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Renovate Bot 630ff39f24 fix(deps): update module golang.org/x/mod to v0.40.0 [security] (#204)
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [golang.org/x/mod](https://pkg.go.dev/golang.org/x/mod) | [`v0.37.0` → `v0.40.0`](https://cs.opensource.google/go/x/mod/+/refs/tags/v0.37.0...refs/tags/v0.40.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fmod/v0.40.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fmod/v0.37.0/v0.40.0?slim=true) |

---

### Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
BIT-golang-2026-56865 / [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) / [GO-2026-6179](https://pkg.go.dev/vuln/GO-2026-6179)

<details>
<summary>More information</summary>

#### Details
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.

This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.

All tiles are now correctly verified against their parents.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

#### Severity
Unknown

#### References
- [https://go.dev/issue/80744](https://go.dev/issue/80744)
- [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI)
- [https://go.dev/cl/814960](https://go.dev/cl/814960)
- [https://go.dev/cl/815020](https://go.dev/cl/815020)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6179) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

### Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
BIT-golang-2026-56864 / [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) / [GO-2026-6180](https://pkg.go.dev/vuln/GO-2026-6180)

<details>
<summary>More information</summary>

#### Details
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.

This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

#### Severity
Unknown

#### References
- [https://go.dev/issue/80745](https://go.dev/issue/80745)
- [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI)
- [https://go.dev/cl/815000](https://go.dev/cl/815000)
- [https://go.dev/cl/815020](https://go.dev/cl/815020)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6180) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Reviewed-on: https://gitea.com/gitea/terraform-provider-gitea/pulls/204
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Renovate Bot <renovate-bot@gitea.com>
2026-08-24 17:17:21 +00:00
.gitea/workflows chore(deps): pin dependencies (gitea/terraform-provider-gitea#191) 2026-07-27 12:56:11 +00:00
.github chore(ci): migrate to GoReleaser v2 (#193) 2026-07-28 23:15:18 +00:00
docs feat(webhook): support slack and current webhook types for gitea_repository_webhook (#178) 2026-07-21 21:37:34 +00:00
examples Fix/135 gitea team drift (#176) 2026-07-18 15:48:14 +00:00
gitea feat(webhook): support slack and current webhook types for gitea_repository_webhook (#178) 2026-07-21 21:37:34 +00:00
scripts chore(deps): Update to Gitea 1.27.2 (#201) 2026-08-14 00:39:17 +00:00
tests version-update in docs and examples (#92) 2025-01-23 02:36:12 +00:00
tools Additional Gitea resources, data sources, and docs 2026-03-24 16:04:22 -04:00
.gitignore feat: add branch_protection resource (#72) 2024-09-11 17:32:48 +00:00
.goreleaser.yaml chore(ci): migrate to GoReleaser v2 (#193) 2026-07-28 23:15:18 +00:00
CONTRIBUTING.md Update examples and test pipeline to fix build. Add additional documentation. Update terraform docs. (#112) 2025-05-16 14:40:46 +00:00
go.mod fix(deps): update module golang.org/x/mod to v0.40.0 [security] (#204) 2026-08-24 17:17:21 +00:00
go.sum fix(deps): update module golang.org/x/mod to v0.40.0 [security] (#204) 2026-08-24 17:17:21 +00:00
LICENSE lerentis's changes (#12) 2023-09-06 01:44:01 +00:00
main.go update import path to use gitea.dev (#170) 2026-05-23 17:26:09 +00:00
Makefile readding install command (#14) 2023-09-07 21:47:00 +00:00
README.md version-update in docs and examples (#92) 2025-01-23 02:36:12 +00:00
renovate.json5 Configure Renovate (#15) 2023-09-07 21:40:26 +00:00
terraform-registry-manifest.json Add 'terraform-registry-manifest.json' 2023-03-31 03:57:18 +08:00

terraform-provider-gitea

Terraform Gitea Provider

This repo is mirrored from https://gitea.com/gitea/terraform-provider-gitea please send all issues and pull requests there.

Usage

This is not a 1.0 release, so usage is subject to change!

terraform {
  required_providers {
    gitea = {
      source = "go-gitea/gitea"
      version = "0.6.0"
    }
  }
}

provider "gitea" {
  base_url = var.gitea_url # optionally use GITEA_BASE_URL env var
  token    = var.gitea_token # optionally use GITEA_TOKEN env var

  # Username/Password authentication is mutally exclusive with token authentication
  # username = var.username # optionally use GITEA_USERNAME env var
  # password = var.password # optionally use GITEA_PASSWORD env var

  # A file containing the ca certificate to use in case ssl certificate is not from a standard chain
  cacert_file = var.cacert_file 
  
  # If you are running a gitea instance with self signed TLS certificates
  # and you want to disable certificate validation you can deactivate it with this flag
  insecure = false 
}

resource "gitea_repository" "test" {
  username     = "lerentis"
  name         = "test"
  private      = true
  issue_labels = "Default"
  license      = "MIT"
  gitignores   = "Go"
}

resource "gitea_repository" "mirror" {
  username                     = "lerentis"
  name                         = "terraform-provider-gitea-mirror"
  description                  = "Mirror of Terraform Provider"
  mirror                       = true
  migration_clone_addresse     = "https://git.uploadfilter24.eu/lerentis/terraform-provider-gitea.git"
  migration_service            = "gitea"
  migration_service_auth_token = var.gitea_mirror_token
}

resource "gitea_org" "test_org" {
  name = "test-org"
}

resource "gitea_repository" "org_repo" {
  username = gitea_org.test_org.name
  name = "org-test-repo"
}

License

This project is licensed under the MIT License - see the LICENSE file for details.

History

This codebase was created at https://gitea.com/gitea/terraform-provider-gitea, was forked by @lerentis, and then their changes were merged back into the original repo. Thank you to everyone who contributed!