Forgejo News

Forgejo monthly report - January 2026

Sat, 31 Jan 2026 00:00:00 GMT

The monthly report is intended to provide an overview of activities in the Forgejo space over the past month. Additionally, this report covers the previous month, December 2025, as well. If you would like to help, please get in touch via the chatroom or take part in the ongoing discussions.

Releases

Forgejo v14

As planned, Forgejo v14.0.0 was released on January 15. However, the days following the release were busy for contributors as regressions and upgrade problems escalated quickly.

The new stateless CSRF protection in Forgejo v14 caused incompatibility issues when Forgejo was accessed via non-HTTPS connections. This issue was discovered on the day of the release. The referrer policy in the HTML template was set to no-referrer, which prevented the browser from sending the Origin header when posting to Forgejo pages. A patch that changed the referrer policy to strict-origin was included in Forgejo v14.0.1, released on January 17.

Unfortunately, a few Forgejo administrators experienced issues with Forgejo v14 database upgrades. One database mysteriously contained no primary keys, and another had an unexpected SQLite table definition format. Such database quirks tend to be common with self-hosted systems, and Forgejo can learn from these situations to make administration easier in the future. Forgejo will soon issue warnings for primary key schema configuration mismatches and use more typical SQLite tools to decrease the risk of these issues.

Forgejo v14 introduced the ability for a Forgejo Runner to fetch multiple tasks with one API call. However, following its deployment on Codeberg, it was discovered that various Forgejo CI jobs were stuck in the "Set up job" phase and did not execute. The root cause was an intermittent bug in the new multiple task implementation that caused some jobs to be sent to the runner, which the runner then ignored. The Forgejo Runner was patched to support the unexpected output, and version 12.5.3 was released. In addition, Forgejo was patched to not provide the unexpected output from v14.0.2 onwards.

On January 29, Forgejo v14.0.2 was released with general bug fixes and dependency updates.

Security releases: Forgejo v11 and v13

Security releases were published: v11.0.9 and v13.0.4 on January 8.

The security team fixed multiple low-severity vulnerabilities. Among other things, there was a fix for instances where email notifications were disabled which could cause a panic when a new commit was made to a PR against a protected branch. Another fix addressed the privacy of user-configured pronouns. Previously, the /repos/{owner}/{repo} API on public repositories allowed unauthenticated users to access the repository owner's configured pronouns, even when access was limited to authenticated users.

Forgejo runner v12

Over the past two months the Forgejo runner received five minor updates and nine patch releases. These releases include multiple new features and bug fixes.

LXC Logging Enhancements

Forgejo relies heavily on Forgejo Runner's ability to run LXC containers for testing purposes. Efforts have been made to address an issue where CI logs occasionally lack critical information necessary for understanding a CI failure. This typically manifests as a test failure where the failure log content is missing at the end. A technical investigation revealed two issues.

The simpler issue was that Forgejo Runner had a race condition when shutting down logging in LXC and host-based executor modes. This could cause the end of the logs to be trimmed. A patch that addresses this issue was included in Runner v12.5.1.

The second issue was that, when executing a command in an LXC container via lxc-attach, the command is subject to rare "short writes" as lxc-attach forwards the log data through the involved pseudo-terminals. This causes brief periods where the logs disappear if the target command writes too quickly for the output buffers to remain available for writing. Forgejo Runner has an in-place workaround that improves but doesn't completely eliminate the problem. Forgejo is not the first to identify this issue, and it has helped validate two proposed LXC patches. A patch has landed in LXC that will address the problem fully when it is available for Debian systems.

Forgejo Helm chart v16 and v15

The v15 version of the Forgejo Helm chart received one patch release, which corresponds to the Forgejo v13.0.4 release. Additionally, a minor release was made, adding the dnsPolicy configuration option to the Helm chart and setting the Recreate strategy as the default for restarts.

Following the release of Forgejo v14, the Forgejo Helm chart received a new major release to update the default Forgejo version. Two patch releases followed for the corresponding v14 patch releases: v16.0.1 and v16.0.2.

Discussions

Mentions of all users in the main chat room

In the main chat room on Matrix, users expressed their dislike of room mentions for announcements (new Forgejo releases, the monthly report, etc). A discussion has been opened to further investigate this issue and hopefully find a solution.

If you use Matrix and are part of the main chat room, please participate in the discussion to help find a solution. Your vote on how you feel about it and what you would like to happen is especially appreciated.

License and copyright attributions in Forgejo's codebase

A discussion has been opened regarding improving the copyright attributions and license assertions in the Forgejo codebase.

Due to the variety of copyright attributions and licenses in Forgejo's codebase, it could be difficult to determine the correct attributions and licenses in some cases. In the discussion, it was proposed that REUSE could be used to solve this issue. Implementing REUSE would require every file to have a license and copyright attribution. If this is not possible for a file, e.g., if it is binary or test data, then the license and copyright attribution must be defined in a separate file. This strategy could also be enforced via CI checks.

Making the entire Forgejo codebase REUSE compliant will be a significant undertaking. Therefore, the suggestion was made to start with a smaller codebase if the proposal is accepted.

If you are familiar with REUSE or similar tools and are motivated to support this effort, feel free to participate in the discussion.

Improving issue to implementation workflow

Over the past month, work has continued on improving the issue-to-implementation workflow. To implement a feature, it is crucial first to understand the problem and then to design a solution that addresses it. Only then can the implementation start.

The current issue creation workflow caused a lot of confusion for reporters and often lacked the necessary information to fully understand the problem. Therefore, new templates have been designed over the last few months in the hope of improving the workflow. To continue improving the workflow, a corresponding discussion exists.

If you have reported issues to Forgejo and would like to help improve the workflow, please participate in the feedback gathering process.

Notable Pull Requests

Actions: Reusable workflow expansion

Reusable workflows are a Forgejo Actions capability that is often used to replicate a common CI job across multiple repositories. This allows one workflow to include another. For example, one workflow can run a different workflow from another repository:

jobs:
  caller:
    uses: my-org/workflow-library/.forgejo/workflows/reusable.yml@main

However, since this capability was implemented, it has been limited. The runs-on field was required, which prevented the target workflow from having multiple jobs with different runners. Additionally, all of the logs from the target workflow were displayed in the UI as a single "Set up job" log entry. This made the capability functional for some cases, but difficult to use and unable to meet more complex needs.

In December, a significant rework was completed across Forgejo and Forgejo Runner to make these workflows more usable and function more in line with users' expectations. This feature has been merged into the next major release, Forgejo 15, and will be enabled by removing the top-level runs-on field.

Forgejo Runner: Unsupported Platforms

Although Forgejo Runner officially supports execution on Linux, a wide range of projects use it in environments that Forgejo does not officially support. Contributors have attempted to incorporate patches to ensure the runner builds on these systems, but that support has frequently regressed unintentionally.

Currently, Forgejo Runner is built on a set of unsupported platforms during CI workflows. These platforms remain unsupported because no tests are executed on them during Forgejo Runner CI, and no release builds are provided. However, this allows contributors to determine whether a change will cause support to regress for other projects and make informed decisions. The goal of this change is to minimize disruption to users on unsupported platforms without burdening contributors' resources.

The unsupported platforms on which Forgejo Runner is built are: DragonFly BSD, FreeBSD, Illumos, NetBSD, OpenBSD, macOS, and Windows.

Auto-linking container images to repositories

Packages in the package registry are uploaded to either an organization or a user. Previously, packages had to be manually linked to a repository in order to be visible in it.

To simplify this process, the handling of packages has been improved. Now, when a package is created, it is automatically linked to a repository based on either the package name or the org.opencontainers.image.source Docker label.

This feature will be available with the upcoming major release, Forgejo v15.

Generate merge commit message in non-mergeable PRs

Previously, merge commit messages generated from the defined template could not be displayed if the pull request was in a non-mergeable state. This meant that, for example, if the conflict was resolved locally and the pull request then underwent manual merging, the merge message also had to be created manually.

This issue has now been resolved with the integration of a new feature that allows the generation of the merge message in the pull request, making it easily accessible for copying.

This feature will also be available with Forgejo v15.

Federation

For a high-level overview, check out the federation roadmap.

Progress has been made on improving the handling of HTTP message signatures. The goal is to to improve scalability and reduce resource consumption by preventing the redundant saving of public keys.

Additionally, steady progress is being made on integrating support for RFC9421 signatures. RFC9421 is used for creating, encoding and verifying digital signatures or message authentication codes over components of an HTTP message. It is an Internet standard that supersedes the commonly used draft version of the same standard on the Fediverse.

Work has also begun on federated searching for remote actors. It uses the WebFinger protocol under the hood, which is a standard for discovering remote actors. This foundational work enables the search for remote repositories and other remote content in the Forgejo explore page.

Overall, federation-related work is steadily progressing, but will still take a lot of time. If you plan to try the existing federation features, please carefully read the warning section in the FAQ first.

Localization

Some maintenance work has been done on the translations.

Indentation in the JSON files has been changed from spaces to tabs.

Additionally, some strings have been migrated from the legacy INI components. This means that the associated history, comments, screenshots, and approval status of these strings are now lost. However, this also marks the beginning of slowly phasing out the legacy components. Notably, the new translation component provides improved plural support for relevant strings. To avoid overwhelming contributing translators with several thousand migrated strings at once, the plan is to distribute the migration in smaller steps over the year.

Infrastructure

Website moved to own infrastructure

Until now, the Forgejo website was hosted on Uberspace.

Since the Forgejo infrastructure has proven to be reliable and is already in place, the website has been moved to the Kubernetes cluster within the Forgejo infrastructure. This allows saving money by using existing resources and gives Forgejo complete control.

If you're interested in how the deployment process works, you can find some documentation in the README file of the Forgejo website repository.

Renovate for website and docs

Renovate is used to track dependency updates. It automatically opens pull requests and depending on the configuration, auto-merges dependency updates. Renovate is already used in many parts of the Forgeio Space and it has now also been added to the website and documentation repo to help maintain dependencies.

Database of code.forgejo.org grew unexpectedly fast

In November, it was discovered that the code.forgejo.org database was growing much faster than expected. Investigations revealed that this was due to bugs in Forgejo. On the one hand, logs from the Forgejo Runner remained in the database even though they should have been moved to the file system. Secondly, it was found that excessive commit_status entries were being created in the database.

Both problems were fixed in Forgejo v14. A new doctor command was also integrated to delete the excess entries from the database. Due to these two bug fixes, the database size dropped from 33GB to 5.8GB.

Full disk on CI server

On January 16, the Forgejo Runner Server ran out of disk space because the Runner Cache fully occupied all available storage. More specifically, the artifacts cache caused the issue. This is probably due to the large Go cache resulting from the many open PRs, which cannot share the cache for security reasons.

The disk layout was restructured, and the cache was moved to a separate 1TB XFS volume.

In the future, it is also planned to add monitoring for the runner to detect issues faster.

Release automation improved

The Release Manager team is responsible for creating Forgejo releases. To simplify the process, the team has implemented extensive automation. Over the last two months, improvements have been made to release automation, and bugs have been fixed.

If activated, the automatic check for new releases uses a DNS-based approach for privacy reasons. The release automation includes a step for updating the domain record automatically, but a crucial step was missing, causing the need for manual interaction.

As part of the release process, the next instance and code.forgejo.org are updated as an additional safeguard to prevent the release of faulty binaries. This update must be done manually by a DevOps member. A script has been written to create a full backup of the instance before updating it to simplify this manual process.

HTML and JSON compression

Compression of HTML and JSON content has been enabled for hosted Forgejo instances and websites. This is done to save bandwidth and improve performance by reducing response sizes.

Moderation

The Forgejo Moderation Team would like to thank everyone who participated in the Forgejo space. It's refreshing to see that most participants strive to be nice and helpful. This not only means that the moderation team has less to do, but also that the Forgejo space is a welcoming environment for all.

We have also updated the Code of Conduct page in the documentation. If you're interested in learning more about the community values or the Code of Conduct, please visit the documentation page.

Other

FOSDEM

Codeberg and Forgejo are collaborating again this year and have a joint booth at FOSDEM. Some contributors from the Forgejo community are present at FOSDEM. If you're attending FOSDEM, come by and say hi! Of course, there are stickers available at the stand. NLnet has probably some different Forgejo stickers, too (hex variant).

Matrix security disclosure

On 16 July 2025, Matrix announced in a predisclosure that a security vulnerability had been found in the current room versions, which had been fixed. This means for us that all rooms on Matrix must be updated.

All rooms except the main chat room were updated.

The main chat room will be updated in the next few days. An announcement will be made before the room is updated.

We forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature.

The following list of contributors is intended to reflect this diversity and to acknowledge all the contributions made over the past two months. If you are missing, please ask for an update.

Forgejo v14.0 is available

Thu, 15 Jan 2026 00:00:00 GMT

Forgejo v14.0, the lightweight, community-developed, self-hosted platform for code collaboration, was released on 15 January 2026. You will find a short selection of the changes it introduces below and a complete list in the release notes.

A dedicated test instance is available to try it out. Before upgrading it is strongly recommended to make a full backup as explained in the upgrade guide and carefully read all breaking changes from the release notes. If in doubt, do not hesitate to ask for help in the chat room.

Summary

Forgejo v14.0 improves everyday usability while strengthening reliability and safety.

Issue and pull request search gains simple inline filters, the web editor switches to a lighter experience, and more parts of the interface work smoothly without JavaScript. In addition, a new stateless CSRF protection allows keeping tabs open for a long time and to resume work without interruptions.

Forgejo Actions adds finer-grained trust controls, better visibility for queued jobs and advanced concurrency and dynamic matrix support. Forgejo's operational reliability has also been enhanced with database deadlock fixes and foreign‑key improvements.

Administrators are recommended to review Commit Status Cleanup for information about an optional post-upgrade data cleanup procedure.

UI features

Search syntax support for Issues and PRs

Several simple search filters are now available in Issue/PR search. Information about usage of these filters is accessible through in-app documentation (click the question mark located adjacent to the search bar) and via the dedicated documentation page. Dropdown filters are compatible with the new simple search filters. [PR]

New file editor

The previous web file editor, Monaco by Microsoft, was overly complex for single-file edits and had issues with performance, loading times, accessibility and mobile usability. It has been replaced with a lighter-weight editor CodeMirror, which is better suited to this use case and resolves the previously mentioned issues.

Switch between formats when previewing CITATION.{cff,bib} files

When previewing a CITATION file (CFF or BIB), a switch allows for switching between formats (other formats could be added, though some libraries have incompatible licenses). The "Cite repository" menu item now links directly to this preview page instead of opening a popup. [PR]

Interact with UI without JavaScript

Work has progressed on making the Forgejo web UI functional without JS. A bug has been fixed, making it possible to post comments without JS enabled. Several ellipsis menus have been made accessible, including the user menu in the navbar. There are now more expandable elements that work without JS.

Improvements to Forgejo actions

Pull Request Trust Management

Forgejo's ability to "Approve" actions execution from a pull request has been enhanced with new options to approve once, always, and deny execution. Once a user is approved for execution, abuse can also be managed by revoking access for execution. [PR]

Commit Status Cleanup

During the Forgejo 14 development cycle, a bug was discovered in Actions that caused many redundant records to be added to the commit_status table while an action was running. In most cases, these records have accumulated since Actions was first developed, affecting all users. A fix for that defect has been introduced in Forgejo 14.

The Forgejo CLI has been augmented with a doctor cleanup-commit-status command which can be used to cleanup redundant records. When the Forgejo Devops team executed this tool on the code.forgejo.org instance, 14.9 million out of 15.2 million records (97%) were identified as redundant records caused by this bug.

$ forgejo doctor cleanup-commit-status --dry-run
2026/01/13 10:43:29 ...git/commit_status.go:527:CleanupCommitStatus() [I] Reviewed 15297011 records in commit_status, and would delete 14916470
2026/01/13 10:43:29 ...git/commit_status.go:531:CleanupCommitStatus() [I] Cleanup commit status took 488488 milliseconds

Two options for the tool allow the administrator to control the memory usage as records are inspected (--buffer-size 100000) and the number of records deleted in each DELETE query (--delete-chunk-size 1000).

Forgejo instances running on SQLite may experiencing locking errors while the cleanup-commit-status command is running due to two processes accessing the same SQLite database files. For a typical SQLite-based instance with few users and light load, this is likely to be short-lived. For a larger SQLite-based instance, it is recommended to run with a smaller delete chunk size, or to run the command while Forgejo is offline.

"Waiting" status Display

Actions that are waiting for a runner with a specific configuration will display this information in the UI, enabling users to easily diagnose why jobs may not be running as expected. [PR]

Concurrency Groups

Forgejo Actions now supports the concurrency block in order to either permit or restrict concurrent execution of a Forgejo Actions workflow. [PR]

jobs:
  rust-checks:
    runs-on: debian-latest
    steps:
      - run: sleep 300

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

Dynamic Matrices & Runs-On

Forgejo Actions now supports matrix jobs and runs-on fields that are defined by earlier jobs in the workflow, allowing a workflow to apply custom logic to determine how and where its jobs will run. In this example, the define-matrix job would be a placeholder for custom logic, such as inspecting the changes in a pull request, to determine which jobs to spawn in the runs-on-dynamic-matrix job:

jobs:
  define-matrix:
    runs-on: docker
    steps:
      - id: define
        run: |
          echo 'array=["debian-bookworm", "debian-trixie"]' >> "$FORGEJO_OUTPUT"
    outputs:
      array-value: ${{ steps.define.outputs.array }}

  runs-on-dynamic-matrix:
    needs: define-matrix
    strategy:
      matrix:
        my-runners: ${{ fromJSON(needs.define-matrix.outputs.array-value) }}
    runs-on: ${{ matrix.my-runners }}
    steps:
      - run: uname -a

[PR 1], [PR 2]

Security features

Validation of the `authorized_keys` file

When Forgejo is configured to use the authorized_keys file for SSH, upon startup this file will be read and its contents will be validated. If any unexpected keys are found in the file, Forgejo will terminate its startup in order to signal to the server administrator that a security risk is present that must be addressed. [PR]

2025/11/07 10:13:50 modules/ssh/init.go:86:Init() [F] An unexpected ssh public key was discovered. Forgejo will shutdown to require this to be fixed. Fix by either:
Option 1: Delete the file /home/forgejo/.ssh/authorized_keys, and Forgejo will recreate it with only expected ssh public keys.
Option 2: Permit unexpected keys by setting [server].SSH_ALLOW_UNEXPECTED_AUTHORIZED_KEYS=true in Forgejo's config file.
        Unexpected key on line 1 of /home/forgejo/.ssh/authorized_keys

Stateless CSRF protection

CSRF attacks are now prevented via a stateless method that uses browser fetch metadata request headers. Because it is stateless, you can now submit work on tabs that have been open for more than 24 hours. Forgejo instances that are hosted on a subpath are no longer protected against CSRF attacks from services that are hosted on the same origin (same scheme, host/domain and port). Anti-CSRF tokens are therefore no longer used and the CSRF_COOKIE_HTTP_ONLY option was removed. [PR]

Database improvements

Goodbye "Pull requests -1" caused by DB Deadlocks

Forgejo maintains statistics on repos, labels, and milestones which have been subject to internal deadlocks when being updated, often surfacing to the user as an indicator that they have "-1" pull requests on a repository. Following scalability work on these calculations, the number of database deadlocks resulting in incorrect statistics or even interrupting merge operations has been effectively reduced to zero. [6 related PRs]

Database foreign keys

Forgejo now implements a limited number of foreign keys in the database. About 5% of the cross-table references that Forgejo uses are protected from data inconsistencies by database foreign keys, which will be created automatically while upgrading to Forgejo 14. [6 related PRs]

Records that previously should have been deleted due to removal of their relationship are considered to be data inconsistencies, and may prevent the creation of a foreign key. For example, if an access token exists in the access table which references a user who was previously deleted, this record should have been removed when the user was deleted but this was never guaranteed by the database due to the lack of foreign keys.

Forgejo will automatically identify these data inconsistencies and correct them to create the necessary foreign keys, deleting the inconsistent records. This will not have any functional impact to your Forgejo instance.

The affected tables and the number of records are reported in the logs during the database migration if any are found.

Distributed database queries

In Forgejo v12 a new feature was introduced to distribute read queries over multiple databases. During testing conducted by Codeberg it was found that this behavior was almost never used. This has been fixed in this release and distributing read queries over multiple databases is now effective. We should note that this is not a high availability feature, there's no mechanism to stop sending queries to a database that is offline. [PR]

Release schedule and Long Term Support

Based on the release schedule, major releases are published every three months. Patch releases are published more frequently, depending on the severity of the bug or security fixes they contain. Forgejo v14.0 is a non-LTS release that replaces the previous non-LTS release, Forgejo v13.0. It will be supported until 16 April 2026.

Version	Release date	End Of Life
11.0 (LTS)	16 April 2025	16 July 2026
13.0	16 October 2025	15 January 2026
14.0	15 January 2026	16 April 2026
15.0 (LTS)	16 April 2026	15 July 2027

14.0-test daily releases

Releases are built daily from the latest changes found in the v14.0/forgejo development branch. They are deployed to the https://v14.next.forgejo.org instance for manual verification in case a bug fix is of particular interest ahead of the next patch release. It can also be installed locally with:

OCI images: root and rootless
Binaries

Their names are staying the same but they are replaced by new builds every day.

Get Forgejo v14.0

See the download page for instructions on how to install Forgejo, and read the release notes for more information.

Upgrading

Carefully read the breaking bug fixes section of the release notes.

The actual upgrade process is as simple as replacing the binary or container image with the corresponding Forgejo binary or container image. If you're using the container images, you can use the 14.0 tag to stay up to date with the latest 14.0.Y patch release automatically.

Make sure to check the Forgejo upgrade documentation for recommendations on how to properly backup your instance before the upgrade.

Contribute to Forgejo

If you have any feedback or suggestions for Forgejo do not hold back, it is also your project. Open an issue in the issue tracker for feature requests or bug reports, reach out on the Fediverse, or drop into the Matrix space (main chat room) and say hi!

Donate

Forgejo is proud to be funded transparently. Additionally, it accept donations through Liberapay. It is also possible to donate to Codeberg e.V. in case the Liberapay option does not work out for you, and part of the funding is used to compensate for work on Forgejo.

However, the Liberapay team allows for money to go directly to developers without a round-trip to Codeberg. Additionally, Liberapay allows for a steady and reliable funding stream next to other options, a crucial aspect for the project. The distribution of funds through Liberapay is transparently controlled using the decision-making process, and Forgejo contributors are encouraged to consider applying to benefit from this funding opportunity.

Thank you for using Forgejo and considering a donation, in case your financial situation allows you to.

Forgejo monthly report - November 2025

Tue, 02 Dec 2025 00:00:00 GMT

The monthly report is meant to provide a good overview of what has changed in Forgejo in the past month. If you would like to help, please get in touch in the chatroom or participate in the ongoing discussions.

Releases

Forgejo v13.0.3

The security team has been busy fixing multiple security issues and has published v13.0.3 and v11.0.8.

These releases fix security issues and some bugs. We strongly recommend that all Forgejo installations be upgraded to the latest version.

Forgejo runner v12

Forgejo runner v12 has been released. This is a major version update due to a change in system requirements, requiring a Git installation. This requirement is included in Forgejo runner's OCI containers. However, binary users may need to install a Git package, and packaging redistributors may need to update for the new system requirement.

Since the last major release noted in the September update, Forgejo runner has received 31 minor bug fixes and seven feature enhancements.

Users may note improved job startup times, reduced resource usage, and more accurate remote tag resolution after remote Git operations were overhauled: 1, 2 and 3.
A Git pre-commit hook was added to allow users to validate their Forgejo Actions files before committing them to their repositories.
Forgejo runner now builds on OpenBSD, DragonFly BSD, and Illumos (with host-executor support only).

Forgejo Helm chart v15.0.3

As usual, the Forgejo Helm chart received a new patch release to update the default Forgejo version to the latest released one.

Accessibility

To provide Forgejo users with disabilities with an easy way to report issues if they cannot navigate to the issue tracker, a second contact point was established through the Matrix channel #forgejo-accessibility:matrix.org. All Forgejo users with disabilities and those interested in addressing them are encouraged to join the chat.

Going forward, the channel can be used to

report accessibility issues with Forgejo instances, shifting the responsibility of issue tracking from impaired users to Forgejo contributors.
discuss accessible design and requirements between contributors and users.
invite potentially affected users to participate in the design process early on via user testing and feedback.

The chat does not replace the issue tracker. Advanced users are still encouraged to use the tracker to report accessibility problems.

User research

The user research team looks for input not only from Forgejo users but also from people who could show us their workflow from other software solutions, such as dealing with moderation reports on social media instances and forums or developing software using other forges. Please help the team by scheduling a 45 minutes research session.

The insights will help improving the contribution workflow, improving instance's moderation tools and provide valuable insights into other topics that are currently in the process of being (re-)designed.

Additionally, there is an ongoing discussion about improving the user research and design workflow. An effective user research and design workflow is essential for developing and implementing features that are relevant to users, easy to understand and intuitive to use.

Federation

For a high-level overview, check out the federation roadmap.

During the analysis of federated user activities, it was determined that Mastodon requires an outbox and that it signs incoming activities differently compared to GoToSocial. Although these issues have been resolved, further analysis is required.

In the meantime, work started on "Enhance Signature Handling for Actors". This will enable signature handling to support more types of actors. Currently, only user and instance actors are supported. Implementation of signature handling for actors began with the addition of support for users and instances.

Handle federated key material as first-class citizens instead of attaching them to their actors: PR.
Simplify signature validation to the least common denominator: PR.
Add support for RFC9421 signatures, which Mastodon may implement soon: PR.

Furthermore, work is underway on the implementation of "Federated Search". The first pull request in progress is:

Enhance Webfinger for upcoming actor types, such as repository or organization: PR.

Infrastructure

Six months ago, distributed crawling hit code.forgejo.org, and the mitigation measures put in place then held until a few weeks ago. The mitigation measures relied on JavaScript-based proof-of-work, but the crawling software learned to resolve the measures, allowing the attack to return.

Since November 24, a new blocking strategy has been implemented and successfully blocked around one million unique IPs daily. Only 5,000 unique IP addresses reach code.forgejo.org daily, and no reports of legitimate traffic being blocked have been received.

Furthermore, transparent Nginx servers were added to act as caching proxies for the /avatars and /assets routes, in order to reduce the load on all Forgejo instances running in the Kubernetes cluster.

Other

Dutch government shows interest in Forgejo

The Dutch government has expressed interest in using Forgejo for its national code platform. Currently, they rely on GitHub, but they are looking for alternatives for storing, collaborating and building government code. This is part of the Open Source Program Office (OSPo)'s efforts to regain digital sovereignty. Throughout the month, a call also took place between a representative from the office and some Forgejo contributors.

Moreover, it is pleasing to hear that the office expressed interest in exploring ways to contribute back to the project.

Matrix security disclosure

The development room was updated on November 23 due to unexpected state behavior. The last rooms to be updated are the Federation and Chat room.

We are monitoring the adoption of the security fix and plan to complete the remaining updates soon. An announcement will be made in each room before it is updated.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature.

The following list of contributors is intended to reflect this diversity and to acknowledge all the contributions made over the past month. If you are missing, please ask for an update.

Forgejo monthly report - October 2025

Sat, 08 Nov 2025 00:00:00 GMT

Releases

Forgejo v13

The release and security teams were exceptionally busy this month. As planned, Forgejo v13.0.0 was published 16 October and the problems discovered during release candidate phase were dealt with in time. There was no last minute surprise.

However, in the hours that followed the release, a serious regression was discovered and a warning was posted to the release notes discouraging anyone to upgrade. It was fixed the next day and a new version published immediately as Forgejo v13.0.1. This was an exceptional combination of bad luck (the root cause is a bug that has been lurking in the codebase for years) and good luck (a fix was discovered a few days before). For more information, please read the postmortem that contains all the details.

On 16 October the security team received a detailed vulnerability report that required immediate attention. It was about a new critical vulnerability that was fixed in the Forgejo v13.0.2 published 26 October. Originally planned to be published 7 November, it had to be expedited because it was leaked publicly, putting Forgejo users and admins at risk.

This cascade of unforeseeable events that required urgent attention is luckily extremely rare. The last critical security fix was two years ago and there never was a regression so severe that it turned out to be necessary to discourage admins to upgrade.

It takes a toll on volunteer team members who were forced to reconsider their priorities to deal with the emergencies. It is also a reminder that releasing a software such as Forgejo requires significant work. If you are reading this, please consider participating to ensure Forgejo releases are both reliable and secure.

Helm chart

Helm chart v15 was released on 16 October. This release is the companion release to Forgejo v13. The version contains two breaking changes, please check the release notes before upgrading.

Additionally a new minor version (v14.0.4) was also published allowing -rootless suffix in image.tag and updating dependencies.

Forgejo is 3 years old

In October 2022, Forgejo was announced in reaction to the takeover of Gitea. After a two months of preparation, the first release was published and Codeberg announced using it.

In March 2024, the hard fork from Gitea happened after weeks of hard work. Later in August 2024, the license of Forgejo was changed to GPLv3+, a Copyleft license, to further manifest and guarantee freedoms to users of the software.

In these past three years, Forgejo matured and transformed into an independent project, with a solid user base and a lively community of contributors. It involved a lot of coding and other time consuming technical work. But it was first and foremost a human adventure, with its share of plot twists and drama.

In the past three years, not only over 1,930 users contributed to Forgejo by reporting a bug, voicing an idea in the chatroom or implementing a new feature, there are also many other projects making Forgejo possible.
Forgejo is built on top of a large Free Software ecosystem involving thousands of people and hundreds of projects. It would not exist without it and, more importantly, it would not be able to move forward without the effort to maintain and develop those dependencies. At this point, we would also like to express our gratitude to many of these projects. Some projects that have particularly influenced Forgejo are listed below. Otherwise, you can gain a deeper insight by reading the license file.

Contrib Projects

forgejo-contrib is a collection of projects that are related to Forgejo, but not under Forgejo's governance. Projects in this space can be supported by Forgejo's Code of Conduct while continuing independent development.

forgejo-cli has been incorporated into forgejo-contrib, by request of its author Cyborus. forgejo-cli interacts with Forgejo's API from the command-line, allowing for easier access to many capabilities like creating a pull request. This project also brings some Rust into the Forgejo-adjacent ecosystem.

forgejo-e2e-report has also been incorporated into forgejo-contrib. It is a development tool for Forgejo that tracks the failure rate of our end-to-end (e2e) test suite and provides a regularly generated report on flaky tests and which browsers generate them. For analyzing the raw logs the project uses DuckDB. In October, the success rate in e2e tests on the forgejo branch dropped as low as 27% in a week, as updated browsers and unreliable tests have combined to make e2e testing frustrating. With the guidance of this analysis, their is the hope to reduce false-positives test failures.

User research

The user research team prepared for another series of user interviews in November, the first one successfully conducted by the end of October. We are looking for input not only from Forgejo users but also from people who could show us their workflow from other software solutions, such as dealing with moderation reports on social media instances and forums or developing software using other forges. Please help us by scheduling a 45 minutes research session with us.

The user research team currently consists of only one person. Following a call for help from several months ago, the user research is for the first time assisted by a second user researcher with the goal to reduce the dependence on individuals going forward.

Federation

For a high-level overview, check out the federation roadmap.

Work on improving the federation related test suite continued. A pull request is in progress to run Mastodon, GoToSocial and Forgejo via HTTPS on the default ports in the end-to-end test.

Sustainability

Forgejo largely profits from its many volunteer contributors. A minority of Forgejo contributors earn a living by developing features or fixes. However, large changes such as improving LFS support or reworking the fundamental workflow for contributions to repositories are usually hard to complete with volunteers only.

In April 2025, a grant application was created and NLnet agreed to compensate Forgejo contributors for a total of € 50,000 for working on various topics. The formalities have been settled by the end of October and the beneficiaries of the grant are now able to start the work.

The grant will wrap up pending work on moderation tooling, improve Git LFS support, do changes to the contribution workflow and fix contrast issues in the themes by creating a semantic set of colors that are supposed to be used with each other. The full list of milestones as agreed by NLnet can be found in the sustainability repository.

Any Forgejo contributor with reasonable experience is encouraged to participate in the grants and can ask to be added as a beneficiary for ongoing or future grants. If this sounds interesting to you, make sure to introduce yourself in the #forgejo-sustainability:matrix.org chatroom.

Infrastructure

The Forgejo infrastructure hosts https://data.forgejo.org which is used by default to checkout the most commonly used actions (e.g. actions/checkout, actions/cache, etc.). It was setup early 2025 to be a more available alternative to pulling them from https://code.forgejo.org/. For instance during the release candidate phase in the Forgejo development cycle, it could be upgraded rather frequently or even be unavailable when a bug is discovered that causes it to unexpectedly shutdown.

And it has been successful with a 99.99% availability for data.forgejo.org in the past 30 days which is better than the 99.95% availability for code.forgejo.org. But it has been suffering from a non fatal issue from the beginning that was only identified and fixed this month. Once per hour on average, sometime more often, cloning an action would take up to three minutes. It never was fatal within the Forgejo infrastructure itself and rare enough to not raise any suspicion. And by the time someone else reported the problem it was gone and assumed to be due to environmental factors unrelated to the Forgejo infrastructure.

For some unknown reason, those delays started to cause rather frequent errors in the Forgejo infrastructure for the first time this month. A series of experiments were conducted and the NFS backend was suspected to be the root cause, although all attempts to obtain actual evidence failed. As the devops team ran out of ideas, the storage backend was replaced with local storage. It rarely is a good idea to try fix a problem without understanding the root cause but it was also a chance to rule out NFS and continue the investigation.

As it turns out switching to local storage solved the problem entirely. The mystery of the occasional NFS slowness is unlikely to be solved as future distributed storage is more likely to be based on either GlusterFS or Ceph.

Moderation

The moderation team is watching Forgejo spaces and used the new v13 moderation tool for the first time, to quickly report spam to the Codeberg Moderation Team.

A user was warned and another user was banned from Forgejo spaces, which was more work. The decision to ban a user is not taken lightly and only happens after repeated attempts to find an acceptable solution through private discussions, over an extended period of time. Moderation is rare (four times only in the past two years) despite a growing number of participant. It suggests that having a zero tolerance policy for behavior going against the Code of Conduct is an effective deterrent.

Other

Matrix security disclosure

On 16 July 2025, Matrix announced in a predisclosure that a security vulnerability had been found in the current room versions and that it had been fixed. For us, this means that all rooms on Matrix must be updated.

Eight rooms have been updated so far, and this work is ongoing. We are monitoring the adoption of the security fix and plan to complete the remaining updates soon. An announcement will be made in every room before it is updated.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature.

The following list of contributors is intended to reflect this diversity and to acknowledge all the contributions made over the past month. If you are missing, please ask for an update.

We Forge - since three years

The following list of contributors is intended to acknowledge all the contributions made over the past three years. If you are missing, please ask for an update.

0ko, 0n1cOn3, 0x00cl, 0x5f, 0xC0ncord, 0xllx0, 1011, 11xx, 242336, 2franix, 413x1nkp, 5225225, 53r1k, 6543, 71rd, 747, 8xLGyCLz, 9pfs, aahlenst, aaronriedel, abacabadabacaba, abc1763613206, abueide, abyxcos, achyrva, acidbong, acioustick, ada4a, adaaa, adachauer, AdamGreenberg, AdamMajer, adamu, addisoncrump, adf19, Adolar0042, adr1enbe4udou1n, adriand, Adrianyyy, adrinux, Adrodoc, adulau, adz, aec, Aeris1One, aimuz, airbreather, aivot-on, ajs124, ajtatum, alanmena, albassort, Albirew, albundy83, aleksi, alex19srv, alex265, Alex2761, alex3305, Alex619829, alexandria, alexAubin, Alexilator, alexrp, alextecplayz, algernon, AliveDevil, aljazerzen, alopez, aloxlamm, alperen, alrs, alsutton, amano.kenji, amartinz, amdim, amearb, amessina, Aminda, Amolith, amoroso, amoutill, ams42, amv-bamboo, anbraten, andar1an, Andre601, andrewgdotcom, AndrewKvalheim, andrewrk, andyquinterom, angelnu, aniva, annoyingusername, anonymous, anorprogrammer, anri, anschuetz, AnselmF, ansemjo, AnsisMalins, antaanimosity, anthony-unicare, antki, AntoninDelFabbro, antoyo, antura-stehak, AntwortEinesLebens, anze, aogier, Apfelwurm, APoniatowski, apoorv569, Application-Maker, apteryx, Aqa-Ib, aqtrans, aral, archk, argrat, arifpedia, arija, arkdae, ArnaudLier, Arsen, Artha, Artiman, artnay, asandikci, ashimokawa, ashur*iraq, atalanttore, Atalanttore, atarwn, Atemu, Athozus, athrun, atimy, Atthaphinya, atticus-sullivan, Atul_Eterno, austinhuang, AverageHelper, avesst, Aviac, aviallon, avidseeker, avobs, awarg, awiteb, Awlex, axaloteDev, axd99, axelsilverdew, axka, ayakael, AYM1607, ayykamp, azmeuk, AzzyDev, b1nar10, Baa, bachorp, bacon, badnetmask, badrihippo, Baempaieo, bagder, bakaroni, balinteus, baltazar, banaanihillo, bapt, barrie, BarryLhm, bart, bartavi, bartvdbraak, barulheira, basebuilder, bat, Baturax, BaumiCoder, bbastin, bbjubjub2494, bbqrob, bdr9, bdube, bdube_gh, Be.ing, be4zad, becm, behm, belette, bencurio, benedictjohannes, bengrue, benjidial, benniekiss, Benny, benteg, Beowulf, Berns, bespinas, bibu5, Bigpappic, billynoah, bitbat, Bixilon, bizdelnick, bjoernager, bkil, blaahaj, BlackSpirits, blaise, blechlawine, bloatfamous, blumia, bmcclure, bmorel, bntn, bodsch, bojidar-bg, Booklordofthedings, bookwar, bookworm, borega, boughtonp, bouncepaw, bowie, bpinsard, BradBot1, brainchild, brainiac, bramh, brano, braydofficial, brechtvl, brenard, brian6932, brigsi, brook, BrunoBernardino, BSD, BtbN, btlogy, buhtz, Bullbagaren, burakozaydin, butterflyoffire, bvandevliet, bziemons, c8h4, CactiChameleon9, caesar, cagrant, camillo, Canard, CanisHelix, captainepoch, carlokok, Carlos17Kopra, carnivorecookies, cartola, catfromplan9, catgirll, cblgh, cbn8krgm, CDN18, cdotnow, CEbbinghaus, cemoktra, CenTdemeern1, cfebs, cgzones, ch0ccyra1n, ChandanTeekinavar, channel-42, charles25565, chavacava, cherryb, cherwey, chizutan5, chlorine, chris420, chrisnicola, christopher-besch, christophjahnke, ChrSt, chrysn, Chucky2401, ciampix, cider, circlebuilder, civodul, CL0Pinette, clarfonthey, ClemaX, clemensgeibel, clementwanjau, CleoMenezesJr, cloud, cmonty14, cmuench, CN-P5, cobak78, code-kungfu, codebert, CodeDoctor, codenyte, coderofsalvation, CodingMonkey, comcloudway, cometship, CommanderRedYT, commonism, con-f-use, ConfusedOnCOFFEE, consteval, consus, copyrights, coralpink, correctmost, CPU_Blanc, crapStone, cregox, Crizomb, crookm, CrowIsTaken, Crown0815, crueter, cryptolukas, crystal, Cs137, CSDUMMI, cstaky, cswimr, cuboci, cuboid, cweiske, Cwpute, Cyborus, cybra, Cynosphere, Cysioland, d-k-bo, d-s, d2735, D3fau4, D3rJust1n, d96b, dachary, daenney, Daeraxa, Daksh2000, dallyger, DamianT, dani-schroeter, daniel-baumann, danielep, DanielGibson, danielhess219, DanielRuf, danielsy, DaniilBuhteev, danjones000, danshearer, DansLeRuSH, darakian, darin755, darix, Dark_Arc, darkicewolf50, darkswordreams, Darthagnon, das-g, dasasd122311, Daschi, DasLixou, dataCobra, davbfr, David-Guillot, davidche, davrot, dawe, dawn-solace, daylien, daym, dbarenholz, dbat, dboerlage, dbushell, dcz, dcz_pf, DD-P, ddevault, ddogfoodd, ddriggs, deadkittens, deblan, DebuggerAndrzej, decimal, defanor, dejan, delgh1, delroth, delvh, denn_moe, denschub, denyskon, depeo, detpikachu, dev_T, devnewton, DevYukine, dgomiller, dharsanb, DiamonC, didyouexpectthat, diem, dikey0ficial, diraneyya, Dirk, div72, DKMellow, dleberre, dmowitz, dmytrish, dnsnet-mdrescher, doasu, dobrovolskyi, dobrvlskyi, docudoc, domi41, domske, doomedguppy, dorianim, douglasparker, dovah-kiin, dploeger, dr_bakterius, DraconicNEO, dragast, dragon, Drakon, drawingpixels, DrDaveD, Dreamboat9222, drewcassidy, DrRac27, drweissbrot, ds-cbo, dss, dsseng, dstensnes, duckinator, dumblob, duxsco, dvonessen, dwt, dyniec, eagle_idea, earl-warren, earthjasonlin, EchedelleLR, ecn, edgalligan, Edgarsons, editfund-founder, eduardosm, eest, efertone, EifionLlwyd, eik, ekaitz-zarraga, EkaterinePapava, ekidney, el0n, eldyj, eli-schwartz, elit-matas, ell1e, Ellpeck, eloy, eludendil, emansije, Ember, emersion, emilylange, Empyrean, eNBeWe, end3r-man, endernon, endz, enricpineda, eo, EOWNERDEAD, equinoxx, Eragon, eramirezinvx, eraviart, Erayd, erikdesmedt, Eriwi, erkinalp, ernest314, ernstki, erral, ERROR404, esainane, esensar, EssGeeEich, etescartz, ethanaobrien, etherportly, EvanCarroll, Eveeifyeve, evie, evrial, ewfg, ewin, ewm, Excrubulent, ExtremelyMAD, ezra, f00, f0sh, f0x, f403, fadedave, famfo, faoquad, faravah, fareycircles, fasterthanlime, fauno, faust, fauxmight, fbausch, FedericoSchonborn, Felitendo, FermeLeLundi, feroli, feroxib, fg_xd, fhuberts, fiesh, FileX, filmroellchen, fina, fio, fiocobbs, firefly-cpp, FirelightFlagboy, Firepup650, Fishwaldo, fistons, Fitik, fito, fjordo, Fjuro, fkiraly, fkooman, Fl1tzi, fl4nn, flactwin, flamenco687, flexstrongo, flightkick, flipreverse, flobeier, floss4good, fluzz, flvffywvffy, flyingfishflash, FML128, fnetX, fnoopv, Fnurkla, fogti, fontenot, forestjohnson, foss-, fossdd, foxy, fpedrei, fr0zi, fr33domlover, fractalf, Frankkkkk, frankm, fraschm98, fraud, freaktechnik, freelock, Freso, frnmst, Froini, fruzitent, Fs00, fschrempf, fsievers, fsologureng, ftrueck, fuggla, FunctionalHacker, Furai, furkangkhsn, furry, fvezzoli, fvidak01, g-a-c, g2px1, gabriel-samfira, gabrielgio, galambborong, GamePlayer-8, gapodo, Gateway31, gbeine, GDWR, gedankenstuecke, gedw99, geed8563, genofire, george.bartolomey, gerald, GewoonLeon, GGORG, ggpsv, Gh0stD3x, GiannosOB, gitcookie-1, GKuhn, glitchedFops, glts, gmask, gmem, gming, Gnaaarwhal, Gnu1, goddess, gogromat, gondolyr, GooRoo, GottemHams, Granular9241, gratux, Gravy59, GreenImp, greenpete, gregdechene, greghellings, grgberg, grgi, gridhead, grisha, grosmanal, Grub4K, GT, gtsiam, guemax, guillerpsanchez, guillomep, guinevere, Guiorgy, gustavblass, GustavoPaterno, Gusted, gwenya, gwhitney, gwymor, h11736083, h3xx, h759bkyo4, haarhoff, hachem, hacknorris, hackos, hahahahacker2009, hailey, hails, halibut, halvin, HamburgerJungeJr, HankB, Hanker, hankskyjames777, hannesm, Hansi231, happenpappen, happwrap, harabat, HaraldToepfer, harbourcoleman, hardillb, HarHarLinks, HarryK, hashirama, Haugli92, Haui, hazy, hb0nd, heartshake, helge, helpimnotdrowning, henrysheehy, herzenschein, hexa, HexagonCDN, hexaheximal, Hiers, HigherOrderLogic, Hill-98, HinoByte, hinrikus, Hiraku, HJVT, hloth, hntin, hoijui, hojerst, holtwick, hook, hoovad, hoppinglife, houkime, how, hra42, hrnz, hscells, httpsterio, huagang, hucksy, hughrun, hugoalh, hugorodrigues, hugosxm, huskee, hwpplayer1, i9e1, iago, iamcurse, IamLunchbox, iaxat, ika, ika-roa, ikidd, ikks, ikuyo, ilesjak, Ilyas0Iks, iminfinity, IndieHum, inetshell, inference, Infernus, Infinidoge, infinoid, intelfx, io7m, iQ, Ironfractal, ironmagma, itinerare, itsdrike, ItsHarper, itsTurnip, iustin, ivanhercaz, izzy, j-dominguez9, j0hnatank, jaahas, Jack252, jackc, JacksonBailey, jacksonchen666, jacobwillden, JadedBlueEyes, jadedctrl, jadeprime, jag, jahanson, jak2k, jakjakob, JakobDev, jalil, james, james2432, JamesBremner, jamie, jan_x7, janAkali, janbc, jank1619, jankatins, janw, jarhodes314, jariasl, jarik, jasonb, javerous, javiertury, jayaddison, jb_wisemo, jbe, jcgl, jcheatum, jdittrich, jean-daricade, jeanbaptisteC, jedik, jednorozec, jeena, jeffersonbledsoe, jelu, Jengro, JeremyStarTM, jerger, jetsung, jexner, jfinkhaeuser, jgarber, jgart, jheiselman, jilen, jinn, jinnatar, jkirk, jklippel, JL710, jlh, jmaasing, jmakov, jmjl, jmshrtn, joebv, joergi, joeroe, jogibear9988, johanneskastl, JohnMoon-VTS, johnnyjayjay, johnthomas00, JohnVeness, JohnWalkerx, Jolly_Good, jomo, joneshf, jonzuka, jorams, jornfranke, jorti, JorTurFer, JoseDouglas26, joxeankoret, jpkhawam, jrtcdbrg, js, JSchlarb, JSylvia007, jthvai, juju4, julianfoad, julianmarcos, JuniorJPDJ, jusko, justbispo, justinsimmons, justknow, Justman10000, jutty, jvdcf, jwakely, jwells, jwijenbergh, jwildeboer, jwolvers, k8ie, kaffeeknecht, KaKi87, kalagane, KalleMP, kallisti5, kampka, karolyi, kassuro, kavash, kaya_emrehan, kayprish, kB01, kbaker, kbruen, kdh8219, kdtresh, kecrily, kemitix, kenzu, kerbless, kevincox, kevinhikaruevans, KFears, khaeru, kibner, kidsan, Kidswiss, kikocorreoso, kilimnik, killawabbit, Killercat103, kinnison, kipvandenbos, KiraRayne, kirrus, kisg, kita, Kitanit, kkremitzki, Kladky, klausfyhn, klavax, KlavsKlavsen, kmpm, KN4CK3R, kne, koalajoe23, kochklops, Kokomo, KOLANICH, Korbs, kot, kpfleming, kraftner, kramo, kreamond, kriffos, krisavi, krumelmonster, Kryesh, kryptonian, kuhnchris, kumi, kuolemaa, kurets, Kwonunn, kwoot, kytta, l_austenfeld, labellson, Lachstec, laegnur, lagerimsi, lampajr, lanodan, laosb, lapo, laptop, laumann, Laxystem, LDericher, leana8959, leandro-costa, leavelet, LecrisUT, lectia, ledyba, leetickett, leherkom, lenikadali, lennartS_lfb, leomeinel, leorize, lepiku, lever1209, Levitating, lfavole, lgierth, Lgmrszd, lhinderberger, liberodark, lime360, limiting-factor, lingling, Link1J, link2xt, Linneris, linos, linux_mclinuxface, LinuxinaBit, linuxpython, LinuxUserGD, lippoliv, lis, litchipi, litetex, lm41, lmaotrigine, lnxgr, lookshe, lord_of_the_dumpster, Lord-KalEl, LordMZTE, lordwektabyte, lorenzop, LostLuma, lotigara, louis9902, lslalbai, ltning, luca-pellegrini, lucajunge, lucasmz, lukawaay, lumi200, Lunar8982, LunarLambda, lunny, luxzi, luzifer, Lvceo, lweller, LWFlouisa, lynnesbian, lynoure, lyssieth, Lzebulon, m_eiman_tlab, m00nwtchr, m0s, m13o, maarrk, maartenbeeckmans, mactynow, MaddinM, mafen, magicfelix, MagicLike, mahiso, mahlzahn, Mai-Lapyst, mainboarder, Maks1mS, MalcolmMielle, maletil, malik, malik-n, maltejur, maltfield, MangoIV, Maniues, manolosd, manuelraa, maralorn, marat2509, marcellmars, marcelovicentegc, marcoaraujojunior, MarcoZehe, Mareep-YANG, mareklach, margau, mariell, mark22k, Mark3xtrm, MarkL4YG, markturney, markuzcha, marshmallow, Marti, martianh, martinarisk, martinr92, martinwguy, mary-ext, master_skylark, matheusgomesms, matheusmoreira, mathilde, matiaslavik, matkoniecz, Matlib, matrss, MatseVH, mattalxndr, matteofranceschini, mattie_sanz, Matze99, maunzCache, maverick2001, maxadamo, maxlath, maya, Mayaleeeeee, MayoDuckPie, maytha8, MB175, mbateman, mborzsony, mcnesium, mcrmonkey, mctaylors, mdaniels5757, mdc_systems, mdione, mdk, mdt, meaz, mee70, megakeegman, mehrad, meisam, melezhik, melonion, melroy89, Menelion, mengzhuo, Merith-TK, MerlijnWajer, meskobalazs, metamuffin, metawave, mewp, meyay, Mez, mf-in-mun, mfenniak, mfil, mfocko, mfxa, MGChecker, mguims, MHLut, mhughes9, mibar, micash, micchickenburger, michael-sparrow, MichaelAgarkov, michaelsasser, MichaelTen, mickenordin, micw, midirhee12, Miguel_PL, mih, Mikaela, mike710shine, mikolaj, milahu, milimarg, mimot, mimsee, minecraftchest1, MinimalMatt, minion, Miraha, mirkoperillo, mirrorwitch, mishra, misyl, mitchplze, mittorn, miversen33, mixed, mjesusdev, mjsir911, mjtimblin, mkobel, mlncn, mlucas, mmarif, mmeier, mmorais, mnalis, mnq, Moiety, mokapot, mokazemi, mondstern, monstorix, monty24, moonglum, moonshadow, moparisthebest, moralpanic, moritzdietz, Mormegil, Morpheus0x, MorsMortium, mortzu, morvy, mpsijm, MrEvil, mritunjayr, mrkwlsn, mrwsl, MSalah73, msavoritias, msfjarvis, msrd0, mst, mstuehrenberg, Mubelotix, muhaaliss, mumulhl, Musselman, mvdkleijn, mverkleij, mwaddoups, mwerle, mxi223, myers, Mylloon, Mynacol, mysticmode, mzhang, n0toose, n2o, N4ta, Nafalan, naipotato, NameLessGO, nasmevka, natct, natkr, NatoBoram, Naxdy, nazunalika, ncc1988, nclm, neamtim, nebras, neighborsbear, neilvandyke, nekoedges, neomaitre, neonew, neox-libre, neox*, nercon, nette, networkException, neuhalje, Neureka, neuschaefer, Neustradamus, nevarr0, neveraskedtoexist, NextFire, nezbednik, ng-dm, nhathaway, nick3331, NickP, NickyTheNeko, NiclasPe, nicoco, NicolasCARPi, NicoleS, nicou, Nifou, Nightfirecat, nightfurysl2001, nightm4re, NihaAlGhul, nihilist1, niklaskorz, nikolayKeniston, nilesh, nilsph, Nirei, nis, Nitrousoxide, njmurarka, nlannuzel, nmmr, Nnnes, nnuuvv, nobodyinperson, noiro, noisytoot, noneangel, Nordfriese, NormPlum, nostar, notevil, noth, notpushkin, notyet, noureddin, npgo22, nrb, NRK, ntn888, Nulo, nvy, nykula, nyncral, nyx_lyb3ra, oatbiscuits, ocdtrekkie, OdinVex, oelmekki, oewbgoieqwb, oliphant, oliverpool, oltdaniel, om, omenos, Omichron, onerandomusername, onitake, openbrian, OrbitalMartian, orkut, ormai, oscarcp, oscarotero, oskardotglobal, ossie, otf31, Outbreak2096, overloop, ozgur, paintgoblin, panekj, panos, pasabanov, paspflue, pastk, pat-s, PatchMixolydic, patdyn, patka, patrickuhlmann, patricus, paulie-aus-punskas, paultag, paulvt, pavel_hushcha, pavi, payas, pboguslawski, Peaksol, pedroberg, pennersr, pensicus, pep., PeterDaveHello, petrcech, petris, peylight, pgmtx, philpep, Pi-Cla, picsel, PierreLannoy, pierreprinetti, pietervdvn, pinjontall94, pinskia, pipcet, Piturnah, pixelcode, PixelHamster, pkpkpkpk, PlayBoxTech, PlexSheep, pluhmen, pluk77, pmb, Pneuma, podhorsky-ksj, pointlessone, polettix, pollux88, polyfloyd, pomp, popey, Porkepix, Porrumentzio, post-factum, poVoq, prcek, privacy1st, PrivateNoob, programmerjake, ProjectPatatoe, Protestant, proton-ab, psa, psentee, psii, pswsm, puer-robustus, Puls3, purkwiat, PurpleBooth, puzzle-it-nu, pwall2222, pyfisch, pylixonly, q3yi, qaqland, QazCetelic, Qippur, qtea, quentin-bettoum, qui, Quitaxd, quokka, qwerty287, r-pufky, r-w-x, R1ckSanchez_C137, r3pek, rabit, raboof, radon512, rafadc, RagnarGrootKoerkamp, rahrah, raimue, raitobezarius, RaphGL, RaptaG, rarogcmex, raspher, rawkode, rdfm, rdsq, rdvn, rdwz, readevalprintloop, realaravinth, RealEnder, recreationalprogamer, recursive_recursion, redbeard, redwerkz, regalialong, reiver, removewingman, rempas, Renich, renken, ReptoxX, retarded-beast, revi, reynir, rfc2549, rguards, rhbvkleef, richardhuxton, Ricky-Tigg, rikh, ringofstorms, ripple_prozac, Rirusha, risottobias, RivenSkaye, RMM, rmorettibr, rmoriz, rmsc, roberth, robertk66, robko23, robsonwaves, RockWolf, rodrigo-gonzalez, rohandebsarkar, rohitkumarankam, rohitsharma09, RokeJulianLockhart, rolandd, romainreignier, rome-user, RonaldAJ, rosano, rosenpapazov, rosna2321, roughnecks, Routhinator, rpoovey, rrahl0, rsm92, rtfb, rudolph, rudolphfroger, ruikkaa, runxiyu, ruuda, ruurd, rvba, rwolters, rwv37, ryan-distrust.co, ryanlerch, Ryuno-Ki, s-l-s, s-light, s1m, s3lph, sachaz, sacm150, Sahtor, salif, salim, Salt, saltstack-admin, salzig, samcday, sammefishe, samrland, SamWhited, sandebert, sandro, sandwitch, santalet, sarahjamielewis, saurabh, sawntoe, sbatial, scabala, schelmo, Schoumi, schwarze, sclu1034, scMarkus, scruel, scy, sdht0, SDKAAA, sdolan99, sdomi, SeaswimmerTheFsh, SebasRebazCoding, senekor, Senku, senorsmile, seodisparate, Septem9er, serendipty01, SergeTheEngi, sergeyk, SerikaFrame, sertonix, Sevichecc, sevki, seyfu-t, sg-phoenix-technologies, ShadowJonathan, ShadowPeo, ShalokShalom, shamann, shanzez, shaowenwan, sheik, shgew, shinebayar-g, shisui, SHuRiKeN, Shuroii, Silejonu, silvasch, silverpill, SilverRainZ, silverwind, simendsjo, simonrolfmore, SIMULATAN, sininenkissa, sinsky, SinTan1729, sirhectorin, skedastically, Skivling, skobkin, Skylark13, Skyper, SLASHLogin, Slate3919, slatian, slingamn, SludgePhD, smartclip_tim, smichel17, smlxdesign, SmolLemon, smxi, sneakers-the-rat, snematoda, snooper3491, SnowCode, Snoweuph, soas, soc, sokai, solemden, solomonv, solonovamax, SomeTr, sosasees, soundstrip, sp6e, SpareJoe, SpencerFabricant, spiffyk, Spinning9247, spla, spooky-overwrite, Squel, SR-G, stanek, stavros-k, stb, stdedos, SteffoSpieler, steko, stelo, stephanm, stevenroose, sthagen, sthenault, stku, stooj, stop5, stratself, strega-nil, strk, strobeltobias, struffel, strypey, stsp, suikan4github, sujiba, sumisukyo, Sunner, sunwoo1524, superjamie, svenseeberg, svoop, swaggboi, Sylphrena, Synchro, syncstack, szethh, t4skforce, tacaly, tace16, tag, taifoss, tallship, talu, tampler, tardich, tarneaux, tclaus, tcpipuk, tdiekel, tebriel, TechnologyClassroom, techokami, Techwizz, tecosaur, ted423, tek256, tengkuizdihar, teo, tepozoa, testserver22, teutat3s, tgy, Thalian, ThatAF, thatonecalculator, thatonecoder, the-real-herowl, TheAwiteb, thebigbone, thecoolcats, thedustinmiller, TheEvilSkeleton, thefinn93, thefox, thekerker, thekeura, themandalorian, theoryshaw, thepaperpilot, therealpim, Thesola10, ThetaDev, thetredev, theycallhermax, thezzisu, thibaulltt, Thibaultmol, thilinajayanath, thisismissem, thodorisl, thomas-maurice, ThomasBoom89, thomasjwebb, thor, thosea, thubrecht, Thyxus, tianon, tilegg, tilera, till, tim-richter, timdeluxe, timedin, timka, timmwille, timotheyca, tiran133, tkbremnes, tmb, toasterbirb, tobiasBora, TobiasUdtke, TobiX, tobru, tofkamp, Tom3201, tomkarho, tonymet, toolforger, toothrot, toras9000, tpoisseau, tragivictoria, transitory, tranzystorekk, trymeout, tschortsch, tseeker, tuaris, tumult2004, tunmiam, tusooa, tuxcoder, tuxmaster, tuxracer, twann, twenty-panda, ty802, tyman, TymekV, uda, ujr, uku, umglurf, uncomfyhalomacro, unikitty, unixery, unlogic, untitaker, update.freak, urda, Use-AIrs, user_naa, VA1DER, vadim, vadiml1024, VadZ, VagabondAzulien, vai, VaiTon, Valenoern, valpackett, valvin, vandenoever, varp0n, VehementHam, ver4a, vetlehh, VewDev, vfosnar, vibce, viceice, VicinityNeurosis, victordargallo, vidya, vikaschoudhary, vintprox, VioletLul, virtulis, Visne, vladh, vlw, voidcontext, volkan, volkmnv, voltagex, vorlif, vpeltnt, vpotyarkin, vroyer, vsz, vtmocanu, VVD, vwbusguy, w8emv, wackbyte, waldyrious, wallabra, walpo, wang3076, wangito33, wangyan, waseigo, watertime, webbj, webfly2, Weebull, werdahias, Werenter, Werzi2001, wetneb, wezm, wh0ami, whitecold, WhyNotHugo, whytf, wickedsmoke, Wild-Turtles, William_Weber_Berrutti, winlogon, wintryexit, wisher, witcher, withlithum, WithLithum, wneessen, wolcen, wolfogre, wolftune, wondercollective, wongandj, woodruffw, woofman420, wookiefriseur, woutput, wrenix, WRMSR, wucke13, Wuzzy, wvffle, X1SystemError0X, XaviCC, xavidcr, xenrox, xerbalind, XeroX, xfix, Xinayder, xinnix, xlii, xlionjuan, xmort, xorander00, XOYZ69, xtex, xtrm, xunzi, xvello, xy, xyhhx, yaash, yann-soubeyrand, yannicka, yannikbloscheck, Yaourt, yarikoptic, yeager, yestax, yeziruo, yoctozepto, yonas, yongbin, yorunin, yp05327, ytimenkov, yuki0iq, yumechi, yumisea, yurtpage, Yushu, yuvi, yverry, zaid1442011, Zalexanninev15, zander, zareck, zbolo-wd, ZDev, zenobit, zerica, zeridon, zhaofengli, ZilloweZ, zimoun, Zip, zl4bv, zloidemon, zokki, zonrek, zontreck, zopsicle, zotan, Zottelchen, ztx, zub, Zughy, zukka77, zwanto, zyachel, zyphlar, ZzenlD

Forgejo v13.0 is available

Thu, 16 Oct 2025 00:00:00 GMT

Forgejo v13.0 was released on 16 October 2025. You will find a short selection of the changes it introduces below and a complete list in the release notes.

Summary

Content moderation is one of the main roadblocks for federation. A first step is now available to users and admins. It was completed while ActivityPub related pull requests were worked on in parallel and merged.

Security was improved under the hood for Forgejo Actions secrets now using a more secure module introduced in 2024 and already in use for TOTP secrets since Forgejo v10. In addition it is now possible to require 2FA instance wide.

Forgejo Actions usability was improved with access to all run attempts of each workflow: they were stored but not available via the web UI. The workflow files are now statically checked, for early detection of errors such as the usage of a wrong context in an expression like ${{ forgejo.server_url }}.

Reporting abusive content

Moderation on public Forgejo instance is a hard and time-consuming task as there are no builtin tools to help with this. Although self-moderation allows users with no elevated privileges to block abusive behavior, it is sometime necessary to get an instance administrator involved.

It is now possible to report users, organizations, repositories, issues, pull request or comments that should be looked at by instance administrators. A category and an explanation of why the content is problematic must be attached.

Those reports are then made available in the admin interface.

When multiple reports are submitted for the same content, they are grouped and the counter from the right side shows how many open reports are linked to that content. Clicking on this counter will open a details page where the full details of all grouped reports can be viewed.

Migration from Pagure

Repositories from Pagure can be migrated to Forgejo. It can be used, for instance, in the context of the transition of Fedora from Pagure to Forgejo that was decided in December 2024.

Configurable global 2FA enforcement

The [security].GLOBAL_TWO_FACTOR_REQUIREMENT setting was added to require two factor authentication (TOTP, etc.) for either all users or instance administrators.

Avatar image privacy

Uploaded avatar images can sometimes contain unexpected metadata such as the location where the image was created, or the device the image was created with, stored in a format called EXIF. Forgejo now removes EXIF data when custom user and repository images are uploaded in order to reduce the risk of personally identifiable information being leaked unexpectedly.

A new CLI subcommand forgejo doctor avatar-strip-exif can be used to strip EXIF information from all existing avatars; we recommend that administrators run this command once after upgrade in order to minimize this risk for existing stored files.

View previous Forgejo Actions attempts

It is now possible to view previous logs for Actions runs that have been retried.

Static check of Actions workflow files

Forgejo Actions workflows are statically verified in the web UI for common errors such as using an incorrect context (e.g. ${{ badcontext.FORGEJO_REPOSITORY }}) or a typo in a required keyword (e.g. ruins-on: instead of runs-on:). It is reported in the action page and the web page that displays the file in the repository.

This is in addition to similar tooling provided by the Forgejo runner itself and helps detect errors as soon as possible.

Show CI status on force push

When force-pushing to a pull request, a line is added to the conversation view to compare the two. However, the CI status of commits in such line was hidden behind an additional click. It is now displayed next to the SHA of each commit, similar to commits from normal pushes.

Markdown editor bold & italic keyboard shortcuts

Keyboard shortcuts were implemented in the markdown editor for formatting features Bold and Italic so that they can be used more quickly. Behavior of using shortcuts is the same as clicking the buttons.

Timestamps on release attachments

The time when a release attachment was uploaded is now shown among other information about it.

Tags are shown in commit lists

When viewing repository's commits, tags are now shown next to the commits they are associated with.

Logger mode settings `LOGGER_<NAME>_MODE`

The logger settings were renamed from logger.<name>.MODE to LOGGER_<NAME>_MODE to help setting them with environment variables when using a container image. For instance:

docker run --rm -e FORGEJO__log__LOGGER_ACCESS_MODE=file ... codeberg.org/forgejo/forgejo:13

Configuration files using logger.<name>.MODE are still supported but they are no longer documented. This change is specially useful when the name of the setting goes through various transformations that convert lowercase to uppercase, such as the Forgejo helm chart.

Release schedule and Long Term Support

Version	Release date	End Of Life
11.0 (LTS)	16 April 2025	16 July 2026
13.0	16 October 2025	15 January 2026
14.0	15 January 2026	16 April 2026

13.0-test daily releases

Releases are built daily from the latest changes found in the v13.0/forgejo development branch. They are deployed to the https://v13.next.forgejo.org instance for manual verification in case a bug fix is of particular interest ahead of the next patch release. It can also be installed locally with:

OCI images: root and rootless
Binaries

Their names are staying the same but they are replaced by new builds every day.

Get Forgejo v13.0

See the download page for instructions on how to install Forgejo, and read the release notes for more information.

Upgrading

Carefully read the breaking bug fixes section of the release notes.

The actual upgrade process is as simple as replacing the binary or container image with the corresponding Forgejo binary or container image. If you're using the container images, you can use the 13.0 tag to stay up to date with the latest 13.0.Y patch release automatically.

Make sure to check the Forgejo upgrade documentation for recommendations on how to properly backup your instance before the upgrade.

Contribute to Forgejo

Donate

Thank you for using Forgejo and considering a donation, in case your financial situation allows you to.

Forgejo monthly report - September 2025

Thu, 02 Oct 2025 00:00:00 GMT

Releases

Forgejo v13.0.0 release candidates

The Forgejo v13.0.0 branch has been cut and the release is scheduled for October 16. code.forgejo.org is running it ahead of time, to discover and fix problems ahead of time. Additionally, a call for help with tests was posted to the chat room for the first time. Preparations for the associated blog post have also started.

You can help us improve it by trying it out and checking that the features you normally use, as well as the new ones, work as expected.

It can be tried on:

https://v13.next.forgejo.org/
your staging environment
your live instance, if you are willing to deal with potential bugs

Before deployment, please read the release notes, address any breaking changes that could affect your deployment and ensure that everything is backed up.

Pre-release versions are available:

as binaries
as OCI images

Report any regressions you find in the issue tracker. If the issues you're facing are related to security, please report them to the security team according to the security policy.

Forgejo runner v11

Forgejo runner v11 has been released. This is the first release since the discussion about changing the license of the runner to GPLv3+ was concluded. This means that, since version v11, Forgejo runner is licensed under GPLv3+, just like Forgejo.

The Forgejo runner release process is lighter than the Forgejo release process. For example, there are no release candidates that are tested in production before the release becomes available to everyone. Consequently, regressions are discovered after the release is published, impacting users who upgrade first. This has happened twice (with versions v10.0.0 and v11.1.0). Fortunately, the regression was discovered on the same day that a new release was published, so the damage was minimal.

Both of these regressions were caused by human error combined with insufficient code coverage. The pull requests that introduced the regressions were properly tested and reviewed properly. However, the author and reviewer overlooked the problem, which occurred in a code path that lacked coverage. The odds of that combination happening again will be lower in the future as code coverage constantly improves.

Call for help

Forgejo runner

The exceptional effort to fix, reproduce and triage all Forgejo Action bugs in the runner and Forgejo itself has been successfully concluded. Currently, there are around twenty open bugs in total, all of which have received attention in the past few weeks.

To keep these numbers low and ensure that bugs do not linger longer than necessary, more contributors are needed. If you would like to help, watch the Forgejo runner repository and grab a bug as soon as it appears. The person who filed the bug may need help providing enough information to reproduce the problem. Once it is confirmed and reproducible, you can start working on a fix right away.

Discussions

Designing a security feature

Although Forgejo is organized and encourages features to be designed and supported by user research, the process is time consuming. The most frequent method of moving from an idea to implementation is filing a feature request in the issue tracker, which is then supported by a pull request.

Allowing Forgejo Actions workflows to run from pull requests that originate from a fork is a long-standing problem, so a design discussion was created to consider all aspects of the problem, including threat modeling, collecting evidence of how users currently cope with the problem, and user interface and user experience.

The scope is limited, but as can be seen by browsing the discussions, it has undergone a few iterations. While time-consuming, this process is ultimately faster than implementing a solution that would require refactoring shortly after release. The reality is that, once a solution is implemented, however clunky it may be, it tends to stay because refactoring is a lot of work, and explaining it to users is difficult. Fixing a problem is easy. Improving an imperfect solution is trickier.

Documentation

Forgejo runner

Many users have trouble using docker commands, such as docker build, with self-hosted Forgejo runners. The default setup blocks access to Docker. A new guide is available to help administrators set this up safely: Utilizing Docker within Actions.

In the monthly report for August, the security warning about the Forgejo runner was removed. However, Forgejo runner still poses a risk because it lets people run code remotely, even when the software is secure. For this reason, another guide was written: Securing Forgejo Actions Deployments. This guide helps administrators to build a secure deployment that is appropriate for their needs.

Feedback on these guides is welcome on the forgejo/docs repo.

Notable Pull Requests

For a number of historical reasons, the Forgejo database currently operates without any foreign key constraints. The project uses alternative compensation mechanisms, such as an extensive and growing test automation suite and a doctor tool that checks and aligns database records for consistency, to ensure data quality. However, the absence of foreign key support is a technical debt to be overcome.

In September, an effort began to enhance the xorm object-relational mapper library in a soft-fork project to support foreign key management across all Forgejo-supported database engines. After adding seven new features for foreign key management to xorm, Forgejo switched to the new version of xorm, which unblocked development of the first foreign key addition.

Forgejo has an estimated 239 relational links between database tables. The first foreign key addition will add four foreign keys, covering about 1.7% overall.

Federation

For a high-level overview, check out the federation roadmap.

Progress on the federation in Forgejo has been ongoing but under the radar this month. The active team around the federation has met twice to prepare and submit a funding application for federated issues, among other things.

Localization

There was an influx of new contributors, higher than usual.

However, even with the simplified renewal process for maintainers, this increase in contributors isn't reflected in the number of applications for maintainers. Currently, this does not cause an issue, but it may in the future. If you are an active translator, please consider applying to be a maintainer.

Infrastructure

Mail server

Codeberg recently setup an SMTP server for its own use and offered it to the Forgejo infrastructure. It is still in the experimental stage and is currently configured for the v11.next.forgejo.org and v12.next.forgejo.org instances only. A webmail has been setup to assist with associated maintenance tasks.

k8s changes testing

Having infrastructure as code brings challenges relating to testing the actual impact of a change. As there are many layers involved, it is not always immediately clear how a single line will affect the YAML files that will be generated and interpreted by the cluster. This can have damaging effects when a bug is introduced.

Snapshots have been added to the repository and can be conveniently updated and compared. Previously, doing so required running non-trivial command lines.

CI hardware crashed

On 15 and 23 September, the hardware dedicated to the runners crashed because the OOM Killer reacted to excessive memory consumption. In both cases the LDAP server that was spawned to test the LDAP Forgejo features was identified as being responsible. However, as it has not changed in years, the reason for this is unclear. This may be related to recent changes in the Forgejo runner, some of which relate to gracefully shutting down services gracefully.

The six-year-old image running an outdated Debian Stretch and an outdated LDAP server has been upgraded. The image is now built from a dedicated repository, derived from a maintained base image, which minimises the maintenance overhead. The old image will be deprecated. The tests had to be slightly adapted to match.

Other

Matrix security disclosure

Five rooms have been updated so far, and this work is ongoing. We are monitoring the adoption of the security fix and plan to complete the remaining updates soon. An announcement will be made in every room before it is updated.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature.

The following list of contributors is intended to reflect this diversity and to acknowledge all the contributions made over the past month. If you are missing, please ask for an update.

Forgejo monthly report - August 2025

Fri, 05 Sep 2025 00:00:00 GMT

Releases

Forgejo security release

The security team has been busy with the fixes that were announced and published in Forgejo v11.0.4 and v12.0.2.

When preparing multiple pull request in advance and in secret, the challenge is to make sure that no unexpected conflicts will arise when they are added to the Forgejo repository, shortly before the release is published. And also to account for the time it takes for the CI to verify a total of 26 pull requests (including backports) knowing each run takes around 30 minutes. It turned out to be around 12 hours of real time, including delays due to errors. There were a few issues (two pull requests required manual merges, some trivial conflict resolution were missed) but their resolution was not too time consuming.

A decision on when and why security releases should be published, has to strike a balance between:

the severity and impact of each vulnerability (e.g. for web endpoints vulnerable to manually crafted identifiers the impact and severity is higher than for this cross-site scripting (XSS) vulnerability).
the frequency of security releases because they can be exhausting for Forgejo admins when there are too many.
the risk of regressions when backporting the fix because it is done in secret and does not benefit from the wider panel of reviewers as the backport worked on publicly.
the attention it requires from Forgejo admins when the vulnerability is difficult to understand, even when the release notes are crystal clear.

For these releases, the decision was made to publish an unusually large number of security fixes (nine) in a single release because:

the severity of each of them is not too high (e.g. compared to the release fixing web endpoints vulnerable to manually crafted identifiers that was published last year).
spreading them on two or three security release would be more work for the Forgejo admins.
only three manual backports out of eighteen are conflicting and the resolution is trivial which reduces the risk of regressions.

The release notes were unified and worded so that the fix is explained first (present tense) and the vulnerability is explained last (past tense) in the hope that it makes them quicker to evaluate and understand.

Helm chart

Helm chart v14 was released on 22. August. This release removes the PostgreSQL and Valkey sub charts. This means that if you are using them, please check the migration guide before upgrading.

As usual, a new minor version (v14.0.1) was also published as the corresponding release to the Forgejo v12.0.2 security release.

Forgejo runner v10

As the year long effort to fix security issues came to an end, the warning about the Forgejo runner being insecure was removed. Security issues are now expected to be reported as per the Forgejo security policy.

The Forgejo security team organized itself with the necessary infrastructure to prepare security fixes under embargo in a private repository. The first of which was announced 22 August and published 1 September.

A regression in v10.0.0 was discovered minutes after it was published. Luckily it as an easy fix and v10.0.1 was published an hour later. The post-mortem of this unfortunate event is rather simple: despite very thorough reviews and extensive automated testing, bugs happen.

Discussions

AI usage in the context of Forgejo

As announced in the previous monthly report, a discussion about how to handle AI contributions began in the Forgejo space at the end of June. A vote was held on the proposals that emerged, and the documentation of the results is currently in progress.

Drafts have been created for the governance and Code of Conduct additions. Only minor details are left to be discussed as part of the documentation and implementation process.

Forgejo runner

As the runner becomes more stable and usable outside the context of the Forgejo project itself, it needs more contributors and a healthy momentum. A discussion started on how to achieve that and at the same time a significant effort was made that successfully increased the activity and allowed new contributors to be onboarded. Maintaining this momentum will be the main challenge of the coming months.

Although features are not the priority, there was an exception: reusable workflows. They were partially implemented and not supported until Forgejo runner v9.1.0 released this month. The main reason for this exception is that, although undocumented and partially working, it was used and bug reports were received. The difficult choice was between removing support for the partial implementation, thus breaking existing workflows that managed to find a happy path or completing the implementation so it could be supported.

Schema validation of actions and workflows

As expected, the schema validation introduced in Forgejo runner v8.0.0 caused some legitimate workflow to fail and the schemas had to be fixed. As of Forgejo runner 9.1.1, all known issues were fixed and there has been no report of unexpected validation failures in the past two weeks.

While investigating a validation error, a bug in the Go YAML package was discovered and reported. Until a fix is available, a simple workaround can be applied: remove the leading empty line. On that occasion it was also discovered that invalid scheduled workflows could block other scheduled workflows and a fix was backported to Forgejo v12 released 31 August.

Codebase re-organization

The activity in Netkos ACT has been low since the beginning of 2024. The main contributor also created a fork but it did not receive much attention in the past six months. In that context a cooperation with an actively maintained codebase seems unlikely.

As all commits from Nektos or Gitea were either ported or cherry-picked in Forgejo, it appeared that it would be easier to maintain a single codebase rather than two separate repositories (runner and ACT). The two repositories were merged on 28 July and the former ACT repository was archived.

actions/artifact@v4 support

The actions/artifact@v4 is used to add files to a job run. It relies on an ad-hoc protocol that is different from anything else and was introduced in Forgejo at the beginning of 2024. It is very useful and frequently used.

Unfortunately the choice to support it by implementing the protocol means that Forgejo is forced to chase and reverse engineer the GitHub server implementation for which only the client side is available under a Free Software license.

Two concrete side effect of that decision are:

the need to maintain a fork of the action that disables GitHub specific verification preventing it from running on GitHub Enterprise and therefore any self-hosted forge.
the need to introduce breaking changes with Forgejo v13 to fix some bugs.

Licensing

A discussion started to change the license of the runner to GPLv3+. It is in line with the licensing agreement of the Forgejo project and no concerns were raised. But, as it is an important decision, it takes a few weeks to be merged and implemented.

Federation

For a high-level overview, check out the federation roadmap.

The work to implement federated user following continued (see the merged pull requests 1, 2). The latest pull request is still in review as preliminary manual testing using Mastodon instead of GtS discovered a bug.

Collecting test coverage for the implementation of federation requires obtaining data from both the Forgejo repository (unit and integration tests) and the end-to-end repository (where GtS is run alongside Forgejo and plays a realistic scenario). When running out of a pull request end-to-end tests now upload coverage data as artifacts to the CI run. They can then be downloaded and manually merged out of a new workflow run of the tests that also uploads the result as an artifact. This would benefit from being automated to be more generally useful but it already allowed for verifying which parts of the federation codebase deserve more testing.

Other

Blog post and talk about Federation

On 14 August 2025, a blog post explained how to experiment with the current implementation of user following.
On 16 August 2025, Jerger held a talk (in German) about federated forgejo at the FrOSCon in Bonn, Germany. It provided insights into the engine room, security considerations, challenges, and the way forward.

FFmpeg using Forgejo

FFmpeg announced in a recent news article that they started to accept contributions via their Forgejo instance available at code.ffmpeg.org. We are pleased by such announcements because they show the results of our daily work.

Matrix security disclosure

As announced in the last monthly report we planned to do the upgrade shortly after the security fix was released. However, the publication and adoption of the security fix didn't go as we expected. As a result, only one room has been updated so far.

We are monitoring the adoption of the security fix and plan to complete the remaining updates soon. An announcement will be made in every room before it is updated.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is intended to reflect this diversity and to acknowledge all the contributions made over the past month. If you are missing, please ask for an update.

Forgejo monthly report - July 2025

Mon, 04 Aug 2025 00:00:00 GMT

Releases

Forgejo v12

Forgejo v12.0.0 was published on July 17 as scheduled. The release also marks the end of support for the LTS release Forgejo v7. We recommend that everyone upgrades to at least the new LTS (Forgejo v11).

A regression involving Minio was identified and resolved less than 24 hours before the release. Another regression was found and fixed after the release. Workarounds were added to the release notes, and it was decided to not publish an immediate patch release.

A week later, Forgejo v12.0.1 was published, which reverts a breaking change that should have been prepared more carefully. An effort has begun that will hopefully allow us to reintroduce it.

Helm chart

A bug fix release was made for v7, which corresponds to Forgejo v7, which is now end of life (EOL). Similarly, a bug fix release was made for v12, which corresponds to Forgejo v11.

v13 and a patch version were released with the corresponding Forgejo v12 versions. v13 represents a significant change because Redis was replaced with Valkey. Furthermore, the PostgreSQL HA subchart underwent a significant update and requires manual migration if used.

Additionally, there is a plan to migrate away from Bitnami for the included PostgreSQL setup because the images are no longer public.

Forgejo runner

Forgejo runner v6.4.0 was published, but unfortunately, it contained a serious regression. After it was fixed, Forgejo runner v7.0.0 was released, and the previous version was no longer recommended.

A few weeks later, the longest-standing security bug of the Runner was fixed (namely, redacting multiline secrets), which was released in Forgejo runner v8.0.0. This version also validates actions and workflows against a schema. Although it is a significant breaking change, it is not optional because:

A workflow or action with random content may lead to unexpected behavior that is difficult to understand and debug.
When something works by chance but is neither documented nor supported, users will depend on it, and it will have to be supported or migrated in a backward-compatible way. This can be very difficult once the Runner is stable.
Errors that are only detected at runtime due to incorrect behavior can be difficult to relate to the root cause, especially when the error is syntactic. Syntactic errors displayed in the Forgejo UI or in the output of a failed job are much easier to identify.

However, some validations were too strict in v8.0.0, so they were relaxed in v8.0.1.

Tooling

The release process is not fully automated yet, but the release manager intends to automate it eventually. The checklist of manual tasks has been clarified. With a major release every three months, ambiguities have time to surface.

The release notes assistant, which collects and compiles release notes, was the main pain point for this release because compiling the notes took about two hours. Created a year ago, the assistant focused on correctness rather than efficiency, and it became problematic, holding up the release for hours for a process that should take only a few minutes. The process was speed up by 20 times and now completes in under two minutes. See also the rationale for not using the most commonly known alternative.

The toolchain used to build Forgejo and Forgejo runner relies on the same action, which builds the binary in a container for each supported architecture. This ensures that the same binary is used both standalone and in the container. It is specialized for Forgejo and unlikely to be used for any other purpose. However, it relies on the forgejo-release action, which has received a few contributions over the past year. Apparently, it is used by other projects, although it was first designed to be specific to Forgejo. It gained support for efficiently using the release-notes-assistant. Forgejo Runner v8.0.1 started using it, meaning changes from pull requests won't need to be managed manually. Only breaking changes and how to deal with them will need to be explained.

Discussions

AI usage in the context of Forgejo

At the end of June, a discussion began in the Forgejo space about how to handle AI contributions. There had already been informal discussions on the topic beforehand.

The discussion focuses on how to handle AI contributions and attribute the use of AI. Several proposals have emerged from the discussion and are currently being voted on. The plan is to officially adopt the proposals afterwards.

Once a decision has been made, it will be announced in either a subsequent monthly report or a separate blog article.

Attribution of contributors in the docs

At the beginning of the month, a discussion began about whether and how authors of the documentation should be credited. The idea is to motivate contributors and show appreciation for their work. The discussion is still in its early stages but has been dormant for the past few weeks.

Communication in the Forgejo space

A conversation about Matrix began in the UI development space, particularly due to the introduction of premium accounts. A discussion was started to document future conversations. This discussion covers what future communication in the Forgejo space should look like.

Other FLOSS communities have experienced similar issues with Matrix and its evolution. Currently, there is a proposal to send an open letter to Matrix encouraging them to return to their core values.

Forgejo runner

Security audit

In August 2024, a security audit was planned for the Forgejo runner. The goal of the audit was to advance the Runner from the Alpha stage of development to the Beta stage and beyond.

Forgejo requested the audit from Radically Open Security through the NLnet grant. ROS helped draft a plan for the audit, which was accepted in September. Actual testing began in November.

Throughout the testing process, we received updates on any findings so that we could develop fixes immediately. These updates resulted in a series of security-focused changes to the Forgejo runner.

The following issues were fixed:

CLN-007: Unrestricted container options (found by ROS).
It was possible to perform privilege escalation by specifying certain container options. This was resolved by filtering the container options.
CLN-002: Runner containers had access to the Docker socket (found by ROS).
The Docker socket was mounted into job containers by default. This allowed workflows to perform privilege escalation. This default has been changed.
Cache access was not authenticated (programmerjake).
Previously, access to the caches was not authenticated. This meant that workflows for one repository could receive caches from other repositories by guessing the correct cache key. This issue has been resolved by requiring authentication to access the caches and by adding a proxy to transparently perform this authentication.
Multiline secrets were not correctly redacted.
Secrets with multiple lines are now redacted properly when printed to the logs.

The complete details about the findings and non-findings of the audit can be found in the code audit report.

As stated above, the last fix was included in v8.0.0, therefore it is highly recommended that you upgrade your runners to v8.0.0 or newer.

No more GITHUB in variable names

Starting with version 7.0.0, the runner allows you to create new workflows without using GITHUB in the names of contexts or variables. This change is mostly cosmetic, which is why it took years to implement. Previous names that include GitHub are preserved for backward compatibility and to facilitate reusing actions originally developed exclusively for GitHub. Shortly after this update was deployed to the Forgejo infrastructure, a series of pull requests were merged to take advantage of the more aesthetically pleasing names.

Reorganization of bugs and features

All issues and pull requests for ACT and the Runner were triaged and sorted. Bug reports are now grouped in the Forgejo runner issue tracker, and feature requests have been moved to a dedicated space. A new workflow was also discussed and implemented on that occasion. In short, it strikes a balance between the expectations of someone filing a new feature request and the need for firsthand testimonies to guide implementation.

To avoid reinventing the wheel, an exhaustive inventory of commits in the Nektos ACT and act_runner repositories was taken and compared to the Forgejo runner implementation. This process covered the last year, during which there was little activity, so it did not take long, and the discovered commits will save valuable development time.

User research

Efforts were made in design and user research (1 and 2) to determine how Forgejo Actions CI results should be handled. This will help determine the next steps now that Forgejo v12.0 has the building blocks to send email notifications when a workflow fails.

Federation

For a high-level overview, check out the federation roadmap.

This month, blockers related to test timeouts (1, 2) that affected development were removed. This now enables further progress on federated user activities.

Sustainability

This month marks the end of the 2022-12-01 grant from NLnet.

The funding enabled some changes to be made to the Forgejo codebase. This was done in exchange for financial compensation.

The completed tasks were:

2023:
- C2: Improvements to the Forgejo Runner and automated setup of Forgejo instances using it.
- A1: Tools to produce the binary Forgejo distribution.
- A2: Tools to produce OCI container Forgejo images.
2024:
- B1: Trigger the release pipeline on a Forgejo instance with a tag pushed by the release manager.
- C1: Improvements to the LXC helper, which provides low-level system containers for use in CI.
- C3: Add support for an LXC backend to ACT.
- B3: Improvements to the webhook implementation and support for https://builds.sr.ht/.
- D3: Improved accessibility when JavaScript is disabled or unavailable for other reasons.
- D4: Fixed accessibility issues identified by an audit.

Funding was extended, enabling the completion of additional tasks in 2025:

F: Moderation - Support for reporting users to the instance admin.
E3: Improved documentation for Forgejo Actions, including splitting it into several easier-to-read pages.
E2: Improved navigation in the documentation (version selector, sidebar).

Further information can be found in the corresponding documentation.

We would like to thank NLnet for supporting these tasks.

Infrastructure

Disaster recover exercise

At the end of 2024, the Forgejo infrastructure migrated to a K8s cluster that is self-hosted on three bare metal machines in Germany and Finland where only free software was installed on top of a Debian GNU/Linux operating system. The cluster is designed to recover from a data center going down in either country without data loss. This was tested when the cluster was first set up. However, it is beneficial to practice the disaster recovery scenario periodically, which occurred on July 24, 2025.

The detailed task list was published for the record. In short, everything went as smoothly as could be expected, except for one detail: NFS-backed Forgejo instances can be extremely slow when going back and forth between Germany and Finland (a Git clone can go from 15 seconds to 5 minutes).

Network outage

Coincidentally, on July 21, the day the disaster recovery exercise was announced, a network outage affected the Forgejo Action runners servicing Codeberg between midnight and 4 AM UTC. While the machines hosted at Hetzner in Finland could no longer reach Codeberg, those hosted in Germany using the same exit point (core5.fra.hetzner.com) experienced no issues. We submitted a support request to Hetzner less than one hour after the outage began, but it did not clarify the problem, which apparently fixed itself. Alternatively, the issue may have been resolved without any information being provided.

With that exception, the Forgejo infrastructure required little to no attention from the DevOps team. This was a welcome change compared to the work required to mitigate and understand the excessive crawling of the previous months.

Hardware costs

The cost of the Forgejo hardware infrastructure was broken down, and the rationale behind it was explained. It has been informally paid for by individuals so far, and a more sustainable model was discussed. It was proposed that Codeberg cover the costs, and the necessary administrative steps were taken. The following months will reveal whether this transition was successful.

Other

Matrix security disclosure

On 16 July 2025, Matrix announced in a predisclosure that a security vulnerability had been found in the current room versions and that it had been fixed. According to Matrix, this was only possible by introducing a new room version.

For us, this means that all rooms on Matrix must be updated. It also means that we have to migrate the Forgejo chat room again. In this case, there will be no manual migration and the update will be performed as direct update of the room version. This means that all clients that support room updates will automatically join the new room.

Nevertheless, there will be a message in the room shortly before the update so that everyone whose clients do not support updates is informed. The distributed rollout of the security fix is planned for 11 August 2025. The plan is to update the Forgejo rooms shortly after the release.

We Forge

Forgejo v12.0 is available

Thu, 17 Jul 2025 00:00:00 GMT

Forgejo v12.0 was released on 17 July 2025. You will find a short selection of the changes it introduces below and a complete list in the release notes.

This release marks the Forgejo v7.0 LTS series as End of Life. Forgejo v11.0 was published three months ago and will be supported until 15 July 2026, when Forgejo v16.0 is published. Admins of Forgejo instances with version v7.0 are recommended to upgrade to v11.0 as soon as possible as only it and v12.0 will receive security patches from now on.

Summary

User research and design is where Forgejo User eXperience (UX) and User Interface (UI) are discussed and improved. It is not about mimicking other forges but observing what users do and improve accordingly. For instance:

Most Forgejo user have visited their profile page at least once and some may use it as their landing page. It is in constant need for improvement while minimizing the impact on habits that users developed over time. The redesign of the user profile was done in that spirit. It adds more actions while also making better use of the available space.
There are a number of hidden features in Forgejo that only few people actually use because their UX is not good enough. The ability to review pull requests one commit at a time was among them and it was made easier to discover and more convenient to use.
Forgejo Actions may be used to schedule jobs that run daily, just like cron. But failures could got unnoticed for a long time, waiting for a user to visit the actions page. By adding an option to the workflow, an email notification can now be sent when a job fails.

In large part because Forgejo is used at scale by Codeberg, performance issues are discovered that are not easily detected on smaller instances. For instance, each open pull request is checked for conflict every time a new commit is pushed to the target branch, blocking the ability to merge them. This I/O intensive and time consuming step is optimized, saving resources and allowing faster merges.

Forgejo security features rely on a mixture OpenPGP and SSH. Since SSH is more widely known, Forgejo is gradually implementing alternatives using SSH for tasks that previously required OpenPGP. In this release it is now possible to use SSH instead of OpenPGP for instance signing.

Excessive crawling is a recurring chore for all Forgejo instances, large and small. A robots.txt file is included by default to reduce the impact of crawlers by letting them know which URLs should be avoided.

Improved UX for per-commit reviews

When a pull request has a well organized series of commit, it may be convenient for the reviewer to focus on each of them individually instead of using the larger diff that shows all of them at once. It is already possible in Forgejo but it is also one of the lesser known features, in part because it was inconvenient to use and discover. This was improved as follows:

The new next ("Next") and previous ("Prev") buttons can be used to navigate the list of commits which is more convenient than using the pull down menu.
The review button ("Finish Review") can be accessed from the per-commit review page instead of being inactive.
The links in the pull request pages (conversation and list of commits) lead to the per-commit review page instead of the commit display page. Unless they were made redundant by a force push.
The commit message is now displayed in the per-commit review page so the reviewer does not need to navigate away to find it.

Keeping forks in sync

If you have a fork and want to keep it synchronized with upstream, the new sync fork feature provides a way to do that. It also indicates whether your fork is behind and/or ahead and by how many commits.

glTF viewer

If you open a glTF model in Forgejo, you will now be able to preview this model in the Forgejo UI without having to download the model and open it in an external tool. Support for previewing other 3D formats is an open issue.

Forgejo Actions email notifications on failure

If a workflow fails, a mail will be sent provided the workflow contains enable-email-notifications: true. The recipient depends on the context:

Pull requests: the user who opened the pull request.
Push: the user who pushed the commit.
Scheduled: the user who owns the repository or the contact email of the organization.
Dispatch: the user who triggered the dispatch.

UI and UX improvements

If you try to create a repository and you have hit the limit on the amount of repositories you are allowed to create, it is now clearer which limit you hit.
The size and dimensions constraints of the custom avatar is now shown in the UI. You no longer have to find out about this requirement after failing to upload an avatar.
Pasting images into the comment editor will now show that image in the 'dropzone'.
The user profile has been redesigned. The most notable change is that actions have been moved to a dropdown and several new actions were added.
The 'Write'/'Preview' switch has been reworked to use the new switch element.
The migration screen was redesigned to make it more usable and make better use of the available screen space.

Automatically refreshing workflows

Endlessly staring at many workflows in the 'Actions' tab to see if they pass is a favorite activity of many developers. Forgejo now refreshes the status of these workflows every 30 seconds so you no longer have to open each workflow in a new tab or wear out your F5 key.

Localized relative time

In many places of the Forgejo UI you will find relative time, the logic of this component was provided by github/relative-time-element. Forgejo encountered two issues with this library: it was not possible to localize the relative time and there are cases that it does not show the correct relative time. This library is now replaced by Forgejo's own implementation (1, 2) that allows for localized relative time and uses a simpler approach to calculating relative time that does not run into the same bugs the previous library did.

Faster conflict checking

Due to Forgejo's nature it relies a lot on Git commands to perform its job in a efficient manner. Forgejo stores repositories as bare repositories and this means that it is not always possible to use commands that require a working tree. For certain operations a temporary clone is created for the sole purpose of using such Git operations. For large repositories this can end up causing a lot of I/O. One of such example was pull request conflict checking, which was reported by a user to cause I/O loads proportional to the amount of open pull requests. Upon re-examining available git commands git merge-tree --write-tree allows for conflict checking to happen without requiring a working tree. If Forgejo is run with a Git version greater or equal than 2.38 you will enjoy this improved performance.

API changes

Two new API endpoints were added to retrieve actions runs of a repository and retrieve specific runs by their ID.
A new API endpoint was added that is able to retrieve multiples blobs at once. This endpoint was added to help get support for Forgejo in Sveltia CMS.
Endpoints that return the metadata of a file now also returns when the last commit was committed. This change helps GitNex with showing this information in directory listings of a repository, similar how Forgejo shows that information.
It is now possible to lists packages and retrieve info about a package without a token if the profile is public. This is public information and was not required to be guarded behind a token check.

Redirecting fediverse handles

Forgejo will now transform fediverse handles (ex. @forgejo@floss.social and !forgejo@programming.dev) into links to https://fedirect.toolforge.org, a website hosted by Wikimedia, to redirect fediverse handles to their respective URLs via Webfinger. Forgejo is working on implementing proper federated mentions that will also notify users on other federated services, which the redirection does not do.

Tabs indentations in the comment editor

If you have typed comments and tried to use Tab you have noticed that it does nothing, this is frustrating especially if you try to type lists. Tab handling is now implemented in Forgejo to do indentations. A lot of time has been spent to make sure it is accessible and works in a consistent and expected behavior to address concerns raised last year in a previous implementation.

Relaxing the requirements on email addresses

In response to a security report Gitea restricted the allowed syntax of email addresses in early 2022 and some email addresses could not be used despite being conformant to the RFC. This change has now been reverted and the security issue that would allow for command injection was fixed, thus removing the need for strict requirements on the syntax of email addresses.

Instance signing with SSH

Commits that are created by Forgejo (e.g. file edits and merge commits) can be signed by the Forgejo instance via a GPG key. It is now also possible to instead use SSH signing, it has the unique capability of being done by a TPM via an ssh-agent. In addition the instance signing documentation was reworded to use clearer language and be easier to read for instance admins.

Removing deprecated API authentication methods

The API has several authentication methods, two of them are now removed after being deprecated in 2023. The two methods would look in the URL query for the access_token and token parameter. Passing authentication via the URL is not secure and can lead to them being logged and thus being exposed. It is now fully removed and there's no option to enable these methods again.

Default robots.txt

Forgejo instances have in the last several months been hit hard by all sorts of new crawlers. One of the easiest way that crawlers disrupt Forgejo instances is by navigating to expensive to serve endpoints, creating many repo archives and filling disk space or getting lost in trying many different issue filters. Forgejo now serves a strong restrictive robots.txt, if no robots.txt is set. This should help with reducing the impact of crawlers that respect robots.txt by not navigating to endpoints that can disrupt Forgejo instances.

Forgejo build time optimization

The build process compresses the frontend assets via gzip into the Forgejo binary with vfsgen so that Forgejo can serve these assets. The build process now compresses the frontend assets with Zstd, which is 4x faster than gzip. As an added benefit, assets are now served via Zstd with a fallback to on-the-fly gzip for browsers that do not support Zstd. It also resulted in reducing the Forgejo binary by 2 MiB.

One of Forgejo's dependencies, specifically go-rpmutils, contained a dependency that is a CGO wrapper around Zstd's reference library. Although Forgejo's did not use this CGO dependency, Go unconditionally compiled it and it took almost as long as compiling the CGO SQLite3 driver. Forgejo now has a fork of go-rpmutils without this CGO dependency, resulting in a shorter build time of Forgejo.

xorm EngineGroup connections for optimized database query routing and load balancing

With this addition, read-only queries are automatically routed to database read-replicas in a load-balanced way, keeping the primary free for writes. Multiple load balancing policies can be selected.

Note: This requires a HA database setup with multiple nodes (at least 3) and only works with Postgres or MySQL.

Reducing the usage of Fomantic.

Forgejo uses Fomantic-UI for historical reasons. In many cases it is not needed, does not provide good accessibility and lock components behind a javascript requirement that could also have been implemented via CSS and semantic HTML. In this release, there are two changes that reduce the use of Fomantic.

The module that dims the entire page and displays a modal has been replaced with Forgejo's own dimming module. This allows browser testing to happen and avoid regressions.
Fomantic-UI comes with a lot of CSS, Forgejo does not use all this CSS. Unused font size classes were removed. This reduces the size of the compiled CSS file and ensures that we do not accidentally depend on it in the future.

Container images based on Alpine 3.22

The v12 container images are built from the latest Alpine 3.22 patch release. It includes:

Release schedule and Long Term Support

Version	Release date	End Of Life
11.0 (LTS)	16 April 2025	16 July 2026
12.0	17 July 2025	16 October 2025
13.0	16 October 2025	15 January 2026

12.0-test daily releases

Releases are built daily from the latest changes found in the v12.0/forgejo development branch. They are deployed to the https://v12.next.forgejo.org instance for manual verification in case a bug fix is of particular interest ahead of the next patch release. It can also be installed locally with:

OCI images: root and rootless
Binaries

Their names are staying the same but they are replaced by new builds every day.

Get Forgejo v12.0

See the download page for instructions on how to install Forgejo, and read the release notes for more information.

Upgrading

Carefully read the breaking bug fixes section of the release notes.

The actual upgrade process is as simple as replacing the binary or container image with the corresponding Forgejo binary or container image. If you're using the container images, you can use the 12.0 tag to stay up to date with the latest 12.0.Y patch release automatically.

Make sure to check the Forgejo upgrade documentation for recommendations on how to properly backup your instance before the upgrade.

Contribute to Forgejo

Donate

Thank you for using Forgejo and considering a donation, in case your financial situation allows you to.

Forgejo monthly report - June 2025

Tue, 01 Jul 2025 00:00:00 GMT

Releases

Forgejo v12.0 on its way

On 25 June the Forgejo v12.0 branch was "cut" as planned. The v12.0/forgejo branch was created out of the Forgejo branch used for development. The same was also done in the documentation, backport labels were created, test releases were built, etc. The release manager is used to automate some of those steps, and improvements were made on this occasion to reduce the number of manual steps that members of the release team need to perform.

On the same day, https://code.forgejo.org was upgraded to the v12.0 release candidate to discover bugs that need fixing before it can be published 17 July. The release schedule was however not published and advertised prominently enough and a few seasoned Forgejo contributors were taken by surprise when the branch was cut. To help prevent that in the future, the release page was reworked.

Forgejo v11.0.2

On 18 June 2025, Forgejo v11.0.2 was released. This update addresses several bugs, including issues with the quote reply feature on Chromium, with pull request cross references and with noise of Forgejo Actions logs.

Helm chart

A patch version of v12 has been released for the corresponding v11.0.2 release of Forgejo.

Additionally, a fix addressing incorrect persistence settings for the postgresql-ha has been released and backported to v7.

Forgejo runner

The Forgejo runner v6.4.0 was released. It upgraded the base image of the container to Alpine 3.22. If building a derived image for your own purposes, please note that update-ca-certificates is no longer included and needs to be installed explicitly if needed.

Aside from a number of dependency upgrades, this release supports offline caching.

Prioritising bug fixes over new features

In software development, it is crucial to balance bug fixes and new features. To improve understanding of this, an addition to the pull request agreement was proposed. The proposal emphasises the prioritisation of bug fixes over the development of new features.

New contributors are often initially drawn to the idea of implementing new features. However, feature development can be challenging for those without a solid understanding of the codebase and team dynamics. Most contributors benefit from a more gradual learning process, which is easier when addressing bugs.

By clarifying that bug fixes take precedence, it becomes easier to provide a clearer path for newcomers. Furthermore, bug fixes tend to receive faster responses from reviewers. This approach improves software quality and helps to integrate new contributors into the team more effectively.

Minimum Git version

As announced in the last monthly report, there was a discussion regarding increasing the required Git version. The proposal was accepted, and the minimum required Git version has therefore been increased from 2.0.0 to 2.34.1. This has already led to a simplification, as obsolete Git version checks have been removed. Going forward, Forgejo will increase the required Git version with each LTS release (and only with LTS releases) to match the oldest Git version supported by Debian stable and Ubuntu LTS in 'Standard Support'.

Notable Pull Requests

In June, multiple improvements were made to the search functionality in Forgejo:

General issue searching was enhanced: Introducing the ability to search by issue number and prioritising title matches when sorting results by relevance.
Improved issue dependency dropdown results: The dropdown now also sorts issues by relevance if a keyword is entered, and shows matching issues in the same repo first.

Federation

For a high-level overview, check out the federation roadmap.

The pull request implementing user following with ActivityPub reached a stage where it passes automated end-to-end tests communicating with GoToSocial. It relieves the developer from the chore of manually testing every aspect of the interactions by launching a Forgejo instance built out of the pull request as well as a GoToSocial instance. They are then driven to follow a realistic scenario that goes like this:

Following the Forgejo account
Creating and federating activities to GoToSocial
Federating activities to Forgejo
Unfollowing and refollowing

Under the hood pull requests were merged in the GoToSocial (1) and Forgejo (1, 2) codebases.

User research

When the CI fails, it is sometimes useful to get a notification and a well organized series of pull requests (1, 2, 3) were merged within short delays this month because they had the required test coverage and were straightforward to review.

The corresponding feature request was submitted over a year ago and was one of the most upvoted. However, it lacked user research, so all the developers could do was come up with the best solution they could imagine. While upvoting a solution is encouraging, it does not replace firsthand evidence that a problem exists and how it manifests itself.

Unsurprisingly, there was no consensus on one aspect of the implementation: should it be opt-in or opt-out? With only a few days before the Forgejo v12.0 branch was cut, there was limited time for proper user research and discussions. However, reverting such a popular feature would have hindered Forgejo's progress. A middle ground was found, and the feature was modified to be opt-in. A user research discussion was also initiated.

One of the core challenges in Forgejo is to fill the absence of user research. Otherwise, problems are likely to be discovered once an implementation is complete because they have not been documented. Hopefully, the experience with implementing Forgejo Actions email notifications this month illustrated why adding a concrete, firsthand example to a feature request helps to move them forward. Each problem statement will make a difference when the developers write the code. They will be more likely to make the right choices for users and less likely to rely on their imagination.

Localization

The Localization Team is the largest team with formal applications, which can result in a large amount of bureaucracy overhead. Team members often forget to reapply unless they are reminded, even if they are still around contributing to the project.

From a translator's perspective, this can be a burden. Those involved in multiple projects may find that participating in Forgejo translation becomes more complex due to the need for frequent renewals.

To address this issue, a governance decision was made to simplify the renewal process. Localization Team admins are now authorised to renew the memberships of non-admin team members if they have no objections.

A modified version of this process has also been applied to the Contributors team.

Statistics

This month, 39 translators were active, 10 more than in June 2024. By that time, we had moved past the ramp-up phase of the previous year, demonstrating healthy growth.

However, the number of applicants to join the team does not align with the overall contributor count. This presents a challenge because we need people to oversee the quality and consistency of translations. Nonetheless, we're optimistic about finding a solution. The important takeaway is the strong enthusiasm for translating Forgejo, which is fantastic!

Infrastructure

The backporting script for the new JSON-based localization has been completed, and the first backport leveraging it happened a few days ago.

Sustainability

At the end of June, our most recent NLnet application, submitted in April 2025, was approved! This is exciting news and will allow us to work on the following:

You can find more information about these tasks in the sustainability repository. The NLnet grant summary can be found on their website.

Matrix chat room migration

The migration of the Matrix chat room has been successfully completed. The old room is now deprecated and read-only, so please join the new room to continue communicating.

You can find the new room under #forgejo-chat:matrix.org.

Other

Forgejo Contribution Workshop

On 20 June 2025, n0toose, famfo, Beowulf and dmowitz held a Forgejo Contribution Workshop at the 23. Gulaschprogrammiernacht (GPN23) in Karlsruhe. The workshop was held in person and about 20 people attended. It resulted in some completed PRs and some others that are currently in progress. We welcome every new contributor to Forgejo!

There are plans for similar workshops in the future at other locations.

Talk about Federation

On 5 July 2025, Jerger will give a short talk in German about the state of federation at the Tübinger Linuxtag (Tübix) in Tübingen, Germany. He will give insights into the engine room, security considerations, challenges and the way forward.

We Forge

Forgejo monthly report - May 2025

Sun, 01 Jun 2025 00:00:00 GMT

Matrix chat room migration

We have been aware of problems with the Matrix chat room for some time. These problems manifested in profile information (usernames and profile pictures) being randomly reset, and member permissions being changed. This is due to state resets which are a known bug in Matrix.

Therefore, it was decided to recreate the Matrix room to solve these problems. This was done on 24 May. The old room is now officially deprecated, so please join the new room and continue communicating there. After a transition period, access to the old room will be restricted and it will become read-only.

You can find the new room under #forgejo-chat:matrix.org.

Releases

Forgejo v11.0.1 and v7.0.15

A security update was released on 2 May 2025 for the two current LTS versions, v11 and v7. This update resolves issues with uploading LFS files and a configured security key is now enforced for external accounts.

We strongly recommend that all Forgejo installations be upgraded to the latest version as soon as possible.

Helm chart

Several minor and patch versions of v12 have been released.

v12.5.1 contains a bug fix related to OAuth configuration. This fix was also backported to version 7 of the Helm chart and released with v7.1.12.

Minimum Git version

A discussion related to the minimum Git version required by Forgejo that began in March was concluded with a consensus. The benefits of this are that supporting newer Git features requires less backward compatibility fallbacks and also provides clearer information on which version is supported.
For Forgejo admins, this means that Forgejo will increase the required Git version with each LTS release (and only with LTS releases) to match the oldest Git version supported by Debian stable and Ubuntu LTS in 'Standard Support'.

Federation

For a high-level overview, check out the federation roadmap.

Work on federated user activity continued this month. There has been progress on following a Forgejo user from GoToSocial. Progress was also made on the reverse: following a GoToSocial user from Forgejo.

Additionally, work on end-to-end testing was carried out. This is intended to ensure that the introduced federation capabilities can be automatically tested, thereby preventing potential regressions in the future.

User interface

This month was packed with housekeeping tasks, such as removing old and unused CSS and making general improvements to the hashboxes.

There were also quality-of-life changes, such as disabling autocapitalization and autocorrect for username fields and ensuring that the activity heatmap displays really old activity correctly, as well as adding messages to otherwise empty user cards.

Localization

This month, approximately 47 contributors were active, including 13 newcomers - an increase of 7 contributors and a decrease of 2 compared to April. Notably, this marks a higher engagement than in May 2024, indicating a healthy growth trend. However, year-to-year comparisons will become more meaningful in the coming months, as we were still in a ramp-up phase during this time last year.

Additionally, we are excited to announce the addition of a new team member for Finnish at the end of April. This has led to significant refactoring and an overall increase in completeness.

Sustainability

Work on the moderation feature, which is funded by NLnet, continued. Task F, which is part of the amended work plan, has been implemented. This gives users the option of reporting inappropriate content to the instance admin. There are still multiple open tasks for the moderation feature, but progress is steady.

Another part of the fund is allocated to documentation updates. As part of this, the Forgejo Actions documentation is being rewritten. The rewrite is currently in the review stage.

Infrastructure

Matrix moderation bot

Draupnir has been set up to simplify the fight against spam and other moderation tasks in Matrix rooms, which are part of the Forgejo space. It is a bot that offers tools for automated moderation as well as simplifications for manual moderation. The Forgejo Moderation Team manages the bot in accordance with the moderation process. Many thanks to the Draupnir team for their help and advice.

Crawlers hitting Forgejo instances

As already mentioned in the last blog post, Anubis has been deployed on Forgejo instances, which are part of the Forgejo infrastructure. As a result, some users had problems with their RSS client because they could not solve the presented challenges. The RSS routes have therefore been excluded from Anubis and are accessible again without any problems.

If you want to know more or have insights to share, check out the discussion "Crawlers hitting Forgejo instances - global abuse trend".

Other

Codeberg enables quota feature

With Forgejo v9, a soft-quota feature was introduced. After some improvements were made in the meantime, like a quota overview in the web interface, Codeberg decided to enable the feature on their instance.
Read more about this in Codeberg's dedicated blog post.

We Forge

Forgejo monthly report - April 2025

Thu, 01 May 2025 00:00:00 GMT

Releases

Forgejo v11.0

It has been a few weeks since Forgejo v11.0 was released and Codeberg upgraded a little later. Preliminary testing by developers who upgraded their own instances before the release date revealed a few regressions that were fixed quickly, resulting in a on-time release on 16 April 2025. Some users encountered minor issues unrelated to the release, and the release notes have been updated to document the fixes (e.g. a case of an internal Alpine container change that is not backward compatible).

Forgejo Actions related work led to an undocumented default that broke workflows relying on it. This may have been fixed for backward compatibility, but Forgejo Actions is still in an experimental stage, so supporting undocumented behaviors wouldn't be sustainable. Nevertheless, every effort is being made to ensure that all changes to Forgejo Action are backward compatible and the end-to-end testing is constantly being improved to increase coverage.

There is additional pressure on this release because it is the second LTS release. Along with upgrades from Forgejo v10.0, there will be upgrades from v7.0, which may cause their own issues. So far, all reported upgrades have been successful, except one. An instance was migrated to v7.0 and from PostgreSQL to SQLite. Migrating from one database to another is not advertised as supported, but it is a common misconception that an SQL dump and the associated table schema can be used with any SQL database. In this case, the Forgejo instance worked, but due to the unexpected format of the SQL table schema, migrations gradually corrupted its definition. It was possible to restore and upgrade the instance with some manual work, but this is not something you want to try yourself.

Security releases v11.0.1 and v7.0.15

There will be a security update for the two current LTS versions, v11 and v7, on 2 May 2025. We strongly recommend that all Forgejo installations are upgraded to the latest version as soon as possible.

Helm chart v12

After the release of Forgejo v11.0, the helm chart was updated to version 12 a day later to ensure compatibility with the latest major Forgejo release. In addition, the release is no longer published to https://code.forgejo.org/forgejo-contrib/forgejo-helm and several dependencies have been updated. In addition, there have been minor releases adding support for Anubis to make it easier to use Anubis. Work has also started on replacing Redis with Valkey.

Call for help

Accessibility and usability

Contributions to Forgejo are growing steadily, but the human effort to maintain it doesn't seem to be growing proportionally. Achieving high quality in Forgejo is a goal, but this also requires reviewing pull requests for accessibility and regressions in usability.

Currently, the accessibility and user research teams are understaffed. So if you have some spare time and are interested in these topics, we would appreciate your help to make Forgejo even better and more inclusive. Please have a look at the call for help if you are interested.

Federation

For a high-level overview, check out the federation roadmap.

Earlier this month a PR about enabling HTTP signatures on all ActivityPub endpoints was merged. HTTP signatures in the context of ActivityPub are often required to interact with a server for authentication and moderation purposes. This merged PR provides an important foundation for further federation work.

In addition, work resumed on the pull request from last year that implements following user activities. This will provide support for following a forgejo user from an ActivityPub server and receiving their activity in the feed.

Sustainability

A new grant application has been submitted for the April 2025 NLnet funding round. Several contributors have applied for a total of €50,000 to complete various tasks. We intend to work on improved moderation tooling, better Git LFS support, making our themes more accessible, and overhauling the contributor workflow. We expect to hear a decision on this application in a few months.

Funded work on the moderation tooling has continued, and we hope to complete all remaining tasks from previous grants soon.

User interface

New improvements to the user interface were merged, making it more modern, consistent and accessible. Some highlights include a reworked switch between comment editor modes and a change to the pagination buttons to ensure that screen readers announce them correctly.

Infrastructure

SSH connection failures

Not long after https://code.forgejo.org/ was upgraded to run the Forgejo v11.0 release candidate, intermittent SSH connection failures were noticed. It took a few days to realize that the problem was not client-side, but server-side: trying to git fetch a repository every 30 seconds would fail at least once an hour for a few minutes. This was frequent enough to start looking for the root cause.

A number of theories were considered, ranging from a v11.0 regression to a client-side bug mistaken for server-side behavior. Finally, it was suggested that the cause might be OpenSSH's built-in mechanism to terminate a connection early if it comes from an IP with a history of abuse, such as an excessive number of failed login attempts.

SSH connections to https://code.forgejo.org/ are reverse proxied, and all connections to the OpenSSH server originate from the same internal (IPv4 or IPv6) IP. It follows that if a bot tries to brute force the SSH port, it will count against these internal IPs, and if the server decides that's too much, it will effectively block everyone for a few minutes by blocking a single IP. The problem is not new, and such intermittent outages have been occurring since https://code.forgejo.org/ migrated to the k8s cluster. It was only recently that they became more frequent and people started to notice.

The chosen solution was to disable OpenSSH's built-in rate limiting feature altogether (PerSourcePenalties no) and rely instead on the reverse proxy that sits in front of OpenSSH. This is not without its challenges, but it is where such a feature belongs instead of being implemented in every service (OpenSSH, Forgejo, etc.) in a different and sometimes unexpected way.

Crawlers hitting Forgejo instances

The discussion about the global trend of excessive crawling hitting Forgejo instances continued as https://code.forgejo.org/ continues to be hit by waves of up to 600,000 unique IPs per day. Thanks to improvements to the k8s infrastructure since the February event, it held up and there was no downtime.

Analysis of this month's event (and various experiments) over ten days revealed the following

This is a case of excessive crawling rather than a DDoS, as it continued at the same pace without impacting service availability.
Most of the millions of unique IPs involved are from residential proxy providers.
This is not cheap: 10TB of data was sent over 10 days, exceeding all advertised proxy provider plans. This is a competitive market where users, voluntarily or through malicious applications, contribute their private IPs and bandwidth in exchange for an estimated $0.1 per GB, which is then sold to the customer for profit.

These findings do not provide clarity on why such excessive crawling occurs, how it is funded, or by whom. However, they are useful in eliminating some speculation. For example, the theory that an individual or organization maliciously tries to increase the load of a Forgejo instance out of anger. This would be plausible if it cost a hundred USD or less. It is very unlikely if it costs at least thousands of USD and requires a non-standard contract with a private proxy provider.

While experimenting, some Forgejo users were blocked on 26 April when attempting to block hundreds of IP ranges. Hundreds of IPs in the same range as them were being used for crawling, and they got caught in the middle. This is a concrete example of how effective residential proxy providers are.

Anubis has been deployed on https://try.next.forgejo.org/ and https://dev.next.forgejo.org/. The instances are victims of excessive crawling and this will reduce the pressure on the Forgejo infrastructure. This was made easy by leveraging new features of the latest Forgejo helm 12.3.0 release. The goal is to eventually do the same on https://code.forgejo.org/ after gaining devops experience running Anubis, if only to deny the data to the organization behind the excessive crawling.

If you want to know more or have insights to share, check out the discussion "Crawlers hitting Forgejo instances - global abuse trend".

Other

Forgejo Contribution Workshop

On 27 April 2025, n0toose held a Forgejo Contribution Workshop at the Chaos Computer Club Aachen e.V. (CCCAC). The workshop was held in person and four people attended. It was a success and led to the discovery of some problems with the onboarding documentation. In addition, it resulted in two completed PRs and some others that are currently in progress. We welcome every new contributor to Forgejo!

There are plans to repeat such a workshop in the future at other locations.

Talk about Federation

Jerger will give a talk in German about the state of federation at the FSCK in Backnang, Germany. It will be a short talk giving insights into the engine room, security considerations, challenges and the way forward.

A recording should be available at https://media.ccc.de/ afterwards.

Recognition by the Git project

The official Git website, https://git-scm.com/, has undergone a recent update. The updated homepage now features a section highlighting various Forges. This change prominently showcases the logos of Forgejo and Codeberg, highlighting the contribution to the broader Git ecosystem.

We Forge

Forgejo v11.0 is available

Wed, 16 Apr 2025 00:00:00 GMT

Forgejo v11.0 was released on 16 April 2025. You will find a short selection of the changes it introduces below and a complete list in the release notes.

This release marks the end of life for the previous stable version v10. The LTS series Forgejo v7 is still supported until 16 July 2025. Forgejo v11.0 will be supported until 15 July 2026, when Forgejo v16.0 is published. Admins of Forgejo instances with version v10 are recommended to prepare for an upgrade in time so that applying potential future security patches does not involve a major upgrade.

Summary

Forgejo v11.0 is the second LTS (Long Term Support) release, following v7.0 published in April 2024. It is the preferred choice for instances that value stability more than newer features published quarterly. Forgejo v7.0 will be supported for three more months, until 16 July 2025, an overlap that allows Forgejo admins to upgrade on their own time.

In addition to this blog post, the blog posts of the releases published since v7.0 contain the highlights of the changes that an instance upgrading directly from v7.0 to v11.0 will benefit from.

New features

Below is short selection of the most notable changes. The complete list is available in the release notes.

PR: user interface to see an overview of the quotas.
PR: add the ability to regenerate access tokens.
PR: welcome screen for user dashboard. It is shown when there's no activity in the feed and can also be customized by instance admins.
PR: display to maintainers in PR when it is editable.
PR: adds the following boolean operators for searching issues when using an indexer:
- +term: term MUST be present for any result
- -term: negation; exclude results that contain term
- "this is a term": matches the exact phrase this is a term
In all cases the special characters can be escaped by prefixing them with \.
PR: add API endpoints with the ability to search for Forgejo Actions jobs (repo, org and global level).

Container images based on Alpine 3.21

The v11 container images are built from the latest Alpine 3.21 patch release. It includes:

Autoscaling capabilities and k8s

End of 2024, a discussion on autoscaling was initiated by a team that is growing, and the workloads they run on Forgejo Actions were increasing. To meet these demands, they needed to increase parallelization when running jobs without unnecessarily blocking or over-provisioning resources. Moving to an autoscaling model would help them achieve this, ensuring that resources are only allocated when there are tasks to process.

Here are the key points:

Pending tasks
- To enable autoscaling for Forgejo runners, Forgejo itself needs to provide a way to obtain the number of tasks waiting to be executed.
- Conversations started with KEDA contributors to create a PR where you can define a Forgejo autoscalers based on these pending tasks.
- These tasks should be accessible at the organization, user, and repository levels and will match how you configure the autoscaler.
Forgejo Runner lifecycle change
- Forgejo runners operate as persistent daemons. To better integrate with KEDA job autoscaling it was proposed to change the runner lifecycle to function as jobs instead of long-running processes.
- An experimental fork of the actual runners existed and added a new command on the code to execute all tasks and exit.
- This allowed runners to scale to 0 when no jobs are running, optimizing resource usage in dynamic environments.

This project was concluded early 2025 and is available both in Forgejo v11.0 and the Forgejo runner v6.3.1:

Release schedule and Long Term Support

Version	Release date	End Of Life
7.0 (LTS)	23 April 2024	16 July 2025
10.0	16 January 2025	16 April 2025
11.0 (LTS)	16 April 2025	15 July 2026

11.0-test daily releases

Releases are built daily from the latest changes found in the v11.0/forgejo development branch. They are deployed to the https://v11.next.forgejo.org instance for manual verification in case a bug fix is of particular interest ahead of the next patch release. It can also be installed locally with:

OCI images: root and rootless
Binaries

Their names are staying the same but they are replaced by new builds every day.

Localization

Forgejo is now available in Danish! The work was started and completed by Tacaly with help of other contributors and coordinated by the localization team.

This release is the first to be shipped with a new format for storing translations better suited for this purpose, enabling better translatability, easier integration with external tooling and better defined syntax. This version supports both new and legacy formats and mostly relies on the latter. A more significant impact of this change is expected to be seen in upcoming versions of Forgejo.

Get Forgejo v11.0

See the download page for instructions on how to install Forgejo, and read the release notes for more information.

Upgrading

Carefully read the breaking bug fixes section of the release notes.

The actual upgrade process is as simple as replacing the binary or container image with the corresponding Forgejo binary or container image. If you're using the container images, you can use the 11.0 tag to stay up to date with the latest 11.0.Y patch release automatically.

Make sure to check the Forgejo upgrade documentation for recommendations on how to properly backup your instance before the upgrade.

Contribute to Forgejo

Donate

Thank you for using Forgejo and considering a donation, in case your financial situation allows you to.

Forgejo monthly report - March 2025

Wed, 02 Apr 2025 00:00:00 GMT

Forgejo v11.0 on its way

The Forgejo v11.0 branch was cut on 26 March 2025 as planned for the target release date of 16 April 2025. It is the second major release prepared with the Forgejo release manager. It was not quite right yet, and the sequence of automated and manually steps has been rearranged for clarity. There is still a lot of room for automation, but the bits that are in place (cutting branches in git, setting new branch protection, archiving backport labels and creating new ones, etc.) already save valuable human time.

Forgejo v11.0 will be an LTS release and will therefore receive security updates for at least a year. However, this also means that the old LTS release v7.0 is approaching the end of support. The end of life for Forgejo v7.0 is scheduled for 16 July 2025. You should therefore be prepared to upgrade your instance if you are running version 7.0.

Forgejo v7.0.14, v10.0.2 and v10.0.3

Forgejo v7.0.14 has been released on 19 March 2025. This release is part of the LTS release cycle and contains two bug fixes.

On 21 March 2025, Forgejo v10.0.2 has been released. This release contains several bug fixes, but also introduced a regression that caused unnecessary escaping of URLs. Symptoms were e.g. not being able to access theme files if they contained a space or double escaping of links. Work to fix this regression started immediately after receiving the report and was fixed in v10.0.3, which was released on 23 March 2025.

The Helm chart for the use of Forgejo in k8s has been updated according to the Forgejo releases.

Forgejo runner

Two new versions (v6.3.0 and v6.3.1) of the Forgejo runner have been released. The latest version v6.3.1 was released on 24 March 2025. Version v6.3 contains a security fix related to caches.

In addition, a blog post is being drafted that summarizes the findings of the security audit that began last year and explains how they relate to the latest security fixes.

Accessibility and usability

code.forgejo.org downtime

An incident occurred on 3 March that caused code.forgejo.org to be unavailable for 7 hours. This was the longest downtime since September 2024, all others lasted less than 10 minutes. The cause is still unknown and it shouldn't happen again: k8s has been modified to restart Forgejo if it goes down for a long time. The pattern of this bug is unknown and has not reappeared since.

Improved Forgejo actions availability

The last step of a major effort to improve the availability of the Forgejo actions repositories has been completed. It started with moving the infrastructure to a k8s cluster and was completed this month with making the actions available as read-only repositories. The setup is based on a git-http-backend behind an apache2 server that is publicly exposed through a traefik reverse proxy.

This improves the availability of data.forgejo.org because:

It is not affected by the DDoS or excessive crawling that recently hit code.forgejo.org, as it does not provide a web interface, only Git Smart HTTP
It is independent of code.forgejo.org and simpler (no authentication, read-only)
There are two servers at all times.

As DDoS and excessive crawling intensify in 2025, and the likelihood of code.forgejo.org becoming slow or even unavailable increases, these changes will prevent the Forgejo runner workflows that need to git clone actions such as actions/checkout or docker/build-push-action from being affected.

OCI registries rate limiting

The Forgejo runner relies heavily on OCI images. They are cached locally when possible, but they eventually hit the registry and can run into rate limiting. Last year the Forgejo CI was interrupted because the host was rate limited by Docker Hub and mirrors were set up to work around the problem. It took a while to change all the references, but it has been months since a rate-limiting problem has surfaced.

A critical moment will come on 1 April 2025, when an even tighter rate limit will be imposed by Docker Hub. If some references were overlooked, disruptions may occur.

DDoS on code.forgejo.org and crawlers

The DDoS that hit code.forgejo.org last month has not returned, and the IP ranges that were blocked are no longer blocked. They mostly covered residential areas, not data centers. The ranges could have been used by a virus activated on a network-connected device connecting from a residential home. There's really no way to tell, and it didn't feel right to continue blocking a large number of IPs, as one of them could belong to a real Forgejo user.

In recent weeks, a growing number of Free Software-related projects (LWN, FreeBSD, Pagure, etc.) have reported similar problems, and there is an ongoing discussion collecting comments and links to what seems to be a global trend in 2025.

This month there was excessive and anonymous crawling by a previously known offender using a different set of IP ranges. This was dealt with quickly as usual by blocking a few IP ranges.

In an effort to improve monitoring of the cluster, Headlamp has been added to the cluster, displaying prometheus graphs of the resource usage of the services running on the k8s cluster. It is promising, but has yet to prove effective for forensic analysis and monitoring of ongoing and emerging problems.

Localization

Improvements have been made to the merge workflow. Previously, when merging pull requests, translation updates were squashed into a single commit. This meant that Weblate components had to be temporarily locked, and it's internal Git branch had to be reset each time. This month, the squash add-on was installed so that Weblate always produces a single squashed commit. This change has made merging pull requests safer, with fewer additional actions. The documentation has been updated to reflect this.

A new linter has been introduced to verify that all translation keys used are present in at least the base language. By default, this linter issues warnings and has already identified several missing translations. This is a valuable addition to the existing testing requirements for new features or fixes and improves the overall quality.

The Danish translation is now complete. The work was started by Tacaly in December 2024 and took about 3 months to complete with the help of other contributors. It will be available in the UI with the v11.0 LTS release.

We Forge

Forgejo monthly report - February 2025

Wed, 19 Mar 2025 00:00:00 GMT

Releases

Forgejo Security Releases v10.0.1 and v7.0.13 were published 8 February 2025 mainly for fixing permissions enforcement of Forgejo Actions and projects; few other bug fixes were also included.

The Forgejo Helm chart had 4 bugfix releases, 2 for each of both v11 and v7.

FOSDEM

As briefly mentioned in the last monthly report, some of the Forgejo developers have been to FOSDEM and met at the Codeberg+Forgejo stand. They met a lot of happy users, discussed ideas and code architecture and finally managed to meet each other in person.

There have been meetings with other projects that are considering to move to Forgejo or became curious about the project. There has been more in-depths meeting with the people at Fedora and talks about future collaboration. Two Forgejo developers have been invited to dinner by Fedora, thank you for that!

You can find a discussion with more impressions from FOSDEM.

Moving to Forgejo

During FOSDEM, we have learned about many projects that are considering or planning a migration to Forgejo, but are blocked due to various aspects. These range from missing features to the need of help setting up or planning the migration. To help keep in touch with interested projects, coordinating migration assistance and tracking necessary additions to Forgejo, a dedicated repository for migrations to Forgejo has been set up.

If you have a success story to share about your usage of Forgejo, or if you have projects that you'd like to see on Forgejo but that are not yet decided or blocked for some reason, feel free to submit to the tracker and let us know.

Forgejo for Enterprise

There is high interest in using a simple and lightweight Git forge for commercial projects. During FOSDEM, we have been surprised to learn about quite some big companies ("off the recording") using Forgejo. However, many potential users are hesitating due to the perceived difficulty in finding commercial support for the software.

Forgejo's ecosystem has several advantages to enterprise customers. Contrary to competing software such as the fully proprietary GitHub, the open core GitLab and Gitea, there is no vendor lock in for Forgejo since is not under the control of a single organization. There is an inventory of professional service providers that slowly evolves to an ecosystem where Forgejo users can freely choose from depending on their needs and satisfaction.

However, these advantages are not yet clearly used to attract customers, and open questions about the influence of business interest have to be discussed. A discussion issue about Forgejo for enterprise has been created for this purpose, tracking the status quo and potential improvements.

If you are using Forgejo for commercial purpose, it might help us a lot if you (ask if you can) publicly write about your case as a success story. Let us know in the issue.

DDoS on code.forgejo.org

On 9 February, code.forgejo.org got hit by a DDoS. To this day, it is still unclear if it was malicious or an excessive number of requests from a crawler.

When code.forgejo.org timedout for the first time on that day, it was thought to be excessive crawling to be blocked, like a number of others in the past months. And indeed, such a crawler was quickly discovered by looking at the logs. It was not obeying robots.txt and did not identify itself with a proper User-Agent header. A small range of IP addresses was added to the existing block list.

When code.forgejo.org timedout again that same day, it was suspected that some IPs of the range were missed. However, after analyzing the logs, it appeared that the large number of requests did not originate from a small number of IP addresses: they were coming from thousands of them.

The k8s cluster hosting code.forgejo.org was setup at the end of 2024 and lacked good visibility on the incoming requests, which turned out to be a problem in this situation. While trying to figure this out, the DDoS slowed down code.forgejo.org so much that it stopped responding. The monitoring in place worked and rang the alarm of the devops team. However it recovered a few minutes later, as if the author of the DDoS was satisfied the service went down and left the scene.

After two days of general slowness and occasional disruptions enough logs were collected and analyzed to conclude that:

The DDoS happened in waves, a few hours apart.
A wave had from 10,000 to 50,000 unique IPs, each sending an average of two requests.
Between 200,000 and 300,000 unique IPs sent requests on a given day.

That was enough to try a simple mitigation:

The IP ranges to which each IP belongs were collected (e.g. 1.7.64.1).
The top 500 IP ranges that contributed the most number of IPs to the DDoS were blocked.

This successfully stopped over 90% of the DDoS and code.forgejo.org recovered. However, blocking entire IP ranges, sometime millions of IPs at a time, was bound to also impact legitimate users. It was discovered on that occasion that the Golang proxies (keeping a copy of Go packages) are using a few different IP ranges and send requests from hundreds of different IPs. They were unblocked, as well as an individual contributor also blocked by accident.

A week later, on 18 February, the DDoS stopped as suddenly as it started. The number of unique IPs hitting code.forgejo.org went from over 200,000 daily to 15,000 overnight. That concluded a DDoS which used around one million unique IPs to hit code.forgejo.org.

DDoS mitigation

The mitigation of the above mentioned DDoS was hand made. It was surprising to discover that Traefik, the reverse proxy used by the k8s cluster hosting code.forgejo.org, does not provide a method to compute and block the top most used IP ranges. It is a radical but effective measure, a practical way to keep the service afloat until the DDoS goes away.

It took a few days to figure out and implement this mitigation, using a number of shell snippets and learning how IP ranges are distributed over the net. In the spirit of saving time to deal with a similar DDoS, an implementation of this method was described to be part of Forgejo. But it does not belong in Forgejo: it should be implemented in a reverse proxy that sits in front and the idea was abandoned.

A blocker to such an implementation was however resolved: figuring out the list of IP ranges currently in use worldwide. In theory it could be extracted from the same database that is used by whois. But some of the Regional Internet Registries (RIRs) publish their database under restrictive usage terms. Instead, the Routing Information Base (RIB) used by BGP is analyzed weekly and around 500,000 IP ranges are compiled and published.

The next time a DDoS hits code.forgejo.org, the logs will be ready for forensic analysis. The latest database of IP ranges will be used for blocking some of them, keeping the DDoS contained until it goes away.

Federation

A second Federation Dev-Gathering took place on 21 February during which the attendees discussed about the current state and possible ways to involve more contributors in order to speed up the development. Also, an old PR for fixing federated stars in case of servers using allow lists for email domain was finally completed and merged while further work was done for unstar action (a first PR was merged and another one is in progress).

Localization

A new component forgejo-next is now in use. Unlike the main component, this one uses JSON for storing strings. It is easier to parse and free of many quirks the INI format has. Currently it only has a few strings, but it suggested that new strings are now added to it. We'll also be moving old strings to it, to eventually get rid of the INI translations completely.

With JSON format Forgejo now also supports language-specific plurals, making translator experience more pleasant and UI more cohesive for languages where there's different number of plurals than two. This improvement will be available in Forgejo v11.

New translations have been started: Hebrew and Romanian.

Sustainability

NLnet, a dutch foundation devoted to the support of free/libre software development, agreed to extend a previous grant for Forgejo by a few months and repurpose the leftover budget. An amendment workplan was agreed on and several contributors started working on it.

The new tasks focus on improving the Forgejo documentation as well as bringing limited moderation capabilities (the option to report content to an instance's administrators). The architecture and database structure has been agreed on. The next tasks include an admin UI. If you are moderating communities via other software or otherwise have valuable insights that could help us design the UX workflows for admins, feel free to let us know in the corresponding design issue.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

Forgejo monthly report - January 2025

Tue, 11 Feb 2025 00:00:00 GMT

Releases

Forgejo v10.0.0 was published on 16 January, one day after the planned release date because a regression was discovered at the last minute. Another issue surfaced a few days later, when migrating Forgejo instances that contained orphaned records in a database table. Such records are not found in any test environment and do not prevent Forgejo from running, but they interfered with the upgrade of two instances. Fortunately, there is a rather simple workaround and the doctor is now able to dispose of them. Codeberg was able to upgrade without incident a week later.

The Forgejo release manager was improved on this occasion. The tasks that are common between patch releases and major releases (release-tasks, release-announce, etc...) were re-used as-is. There are still a number of items that need to be done manually and they can gradually be automated within this framework.

The Forgejo runner v6 major release was published continuing the effort to fix security issues and to bring it closer to a beta stage. It also contains support for ephemeral runners and force rebuilds.

A new major release of the Forgejo helm chart was published 15 January. It contained a regression that was fixed the next day, with 11.0.1. It has a few breaking changes and defaults to using Forgejo v10.0.0. The Forgejo helm v7.1.7 patch release to be used with Forgejo v7 was also published.

Translations

A PR initiating the switch to a more flexible translation format has been merged, however, a bug was discovered in Weblate that prevented a new component from being used right away, seemingly because Forgejo is pioneering usage of go-i18-v2 format in Weblate. @Gusted figured it out and submitted a fix to upstream. It has been merged, but we're waiting for a Weblate update which will include that fix.

Filipino translations were completed (thanks to the effort of @kita) in December 2024 and have been released for the first time in the v10 release in January. Similarly, Lower German is now available as a new language. Especially since there are comparatively few speakers, we are proud to be among the software projects available in these locales.

FOSDEM

Forgejo and Codeberg had a stand during FOSDEM February 1 and 2 in Brussels. We might go into details about this in the February update (because, well, apart from travelling there most of it happened in February anyway and we still need to wrap things up on our end). You can read and participate in our discussion about this year's FOSDEM, feel free to share your impressions.

It was a pleasure talking to so many of you, and the first time many of our team members have seen each other in person. Thank you for your trust and support, and for distributing our stickers!

Federation

If you follow the Forgejo monthly reports, you might have noticed that we haven't written about federation recently, and some of you asked about it. We apologize for the omission, but rest assured: Federation is still a high priority and we haven't given up on it.

Due to personal constraints, things have slowed down a little bit by the end of the year. With federated star, a first user-visible feature has been implemented and some follow-up PRs have been in development, but not yet merged. Federated unstar (which complements the starring of repos) will be the next task, but due to it being a little destructive, more backend work is happening. The developers briefly talked about this during their FOSDEM talk and first code was submitted by the end of January.

A federation roadmap was developed and discussed, which provides the next steps and their requirements to make federation useful in some capacity. There is commitment to complete some of these milestones in 2025.

To ensure the federation project can move on regardless of limited funding capabilities, it was agreed to compensate the current federation maintainers for maintenance jobs such as code review and onboarding with up to € 500 / month. This ensures that community contributions to federation can be reviewed and merged quickly. The funding was provided to Forgejo by Codeberg e.V..

Website and documentation

Forgejo actions were implemented to check for spelling mistakes upon pull requests, both for documentation and website using the source code checker typos. To our positive surprise, there weren't many spelling mistakes on the website, which means that Forgejo's contributors already did a good job in detecting those during blog post draft approval.

Broken links are an annoyance to readers of the website. The amount of those in the documentation was significantly reduced thanks to the scheduled link check action. It uses the lychee binary and was added to the website pages, too. While implementing, too many requests were sent to codeberg.org and mistaken for abuse, we're sorry for that! Fortunately, the server is set up with automatic mitigation of such events by blocking the concerned IP address for half an hour. The reason was the massive amount of links to contributors, which are now excluded from the daily link checks.

Apart from the usual documentation improvements, the documentation footer on the website has been improved to properly attribute the authors of derived CC-licensed work and the edit link has been replaced to point always to the related document in the next branch.

To further simplify the release process, when building the website, latest and LTS releases are now automatically retrieved using the recently introduced release schedule.

Work has started to improve the accessibility of the Forgejo's website, such as adding a global search and documentation version switches. Contributions are always welcome to both the website source and the documentation.

Infrastructure

On the day of the Forgejo v10.0.0 release, the IP of the machine running the workflows responsible for the release was rate limited by https://hub.docker.com/ which host most of the container images used in the CI. It disrupted a number of workflows and had to be dealt with immediately. All workflows were modified months ago to use Forgejo hosted mirrors updated daily to prevent that kind of disruption but some references were overlooked. After they were fixed, the workflow responsible for the release was no longer rate limited and the release could proceed.

code.forgejo.org went down during 15 minutes on 21 January 2025. It was the first unscheduled downtime since 9 September which lasted about 10 hours. Read more in the post-mortem.

About two years ago, Forgejo action runners were installed manually on a machine that is still in use today. It grew over time and around twenty were also installed manually. Ideally they could all be migrated to the new k8s cluster but there is no LXC support in k8s and it is required for a number of workflows that cannot run out of application containers (podman or docker).

A script managing a systemd unit dedicated to the runner was created and used to manage all runners with familiar commands such as systemctl start forgejo-runner@42.

Dependency management

The forgejo dependency configuration and the renovate organization (formerly in forgejo-contrib) are the central point from which the dozens of repositories involved in the making of Forgejo (CI, tools or releases) are watched. It automates the obvious but tedious task of ensuring, for instance, that the go release found in go.mod has an up-to-date version with regard to security vulnerabilities.

Doing so for an individual repository (which was the starting point of that effort with the main Forgejo repository in 2024) is convenient but it does not scale well. To help with that, shared configurations (see the one used by Forgejo for instance) have been created and underwent significant improvements this month.

In some cases, such as dependencies that are only used in the CI, it is OK for a pull request containing an upgrade to be merged unattended as soon as the workflows pass. This is what the automerge feature is for but it left a branch behind because it was not supported prior to Forgejo v10. The Forgejo driver for renovate was patched and there are no longer lingering branches after an automerge.

A number of additional repositories were added to the pool of repositories that renovate watches and it is no longer necessary to individually approve them, as long as they belong to a known organization.

Because renovate was not in use in 2023 (or in some cases where scripting is involved), some dependencies are not specified in a way that renovate can natively discover. For those, dedicated rules are being developed which run the equivalent of sed -i -e 's/old version/new version/' on the designated file (e.g upgrading the RUNNER_VERSION file in setup-forgejo).

Now that dependency management has mature tooling in all Forgejo spaces, it is easier for both volunteers or paid staff to review each individual upgrade. There are just a few every day but most of them require human scrutiny. A call for participation was posted and will hopefully be attractive to people willing to contribute to Forgejo.

Moderation incidents

January was a little noisy regarding moderation actions. There have been cases of community members that created a lot of noisy issues, presumably with the help of AI tools. While probably in good faith, throwing walls of text by increasing the amount of open issues in forgejo/discussions by 10% in only a few days as well as responding with huge amounts of text to even simple questions was exceeding the capacity of our volunteers to deal with.

Additionally, some new contributors required a lot of help, started heated discussions, or obstinately pushed their own ideas even if they faced disagreement by several other community members. These incidents have created a slightly tense atmosphere for a few days.

Luckily, the community has openly talked about the incidents, both in issues and in the Matrix channel, and most of the problems could be resolved quickly. There have been cases where the noise has led to premature reactions by some maintainers, for example when a lengthy issue has been reported as "spam" or "trolling", even if they might have been created without bad intents.

We apologize if you have been impacted by any of these incidents, either because an issue you have reported has been flooded with heated discussions, or because a contribution from you has been flagged too quickly. If you think one of your contributions did not receive the attention it deserved, feel free to carefully reopen or recreate it, respecting the pace at which the community can possibly deal with them.

The exceptional level of tensions lasted for a few days and calmed down again. We expect that this was mainly bad timing to have multiple such cases at the same time and there are no signs this would repeat in the new future. Nevertheless, a new moderator was proposed to increase the human resources within the Forgejo moderation team.

Forgejo strives to be an inclusive project where everyone can participate in a safe environment. If you, as a community member, feel unsafe for any reason, feel free to reach out to the moderation team.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

Forgejo Security Releases v10.0.1 and v7.0.13

Sat, 08 Feb 2025 00:00:00 GMT

Forgejo v10.0.1 and Forgejo v7.0.13 were released 8 February 2025.

This release fixes permissions enforcement of Forgejo Actions and projects.

This release also contains other bug fixes, as detailed in the corresponding milestone.

Recommended Action

We strongly recommend that all Forgejo installations are upgraded to the latest version as soon as possible.

Impact

These security issues can be exploited:

by users who are registered on the instance, to delete Forgejo Actions runners and variables or modify variables.
to get the titles, authors, labels and creation dates of issues or pull requests in private repositories, when they are referenced by a project from the containing user or organization.

Forgejo Actions web endpoints vulnerable to manually crafted identifiers

Some Forgejo Actions related web endpoints, such as deleting a Forgejo Actions variable, rely on an identifier unique to an object (a variable in this example).

The permissions required for the user performing the action on the repository are properly enforced. But a check was missing to ensure that the object (a variable in the example) also belongs to the repository the permissions are checked against. Without this check it was possible both to perform destructive actions (runners and variables) or to modify variables in repositories unrelated to the request, including private ones.

The vulnerable endpoints were fixed and tests were added to verify the fixes are effective.

User or organization wide projects leaking information about private issues or pull requests

If a project is created in a user or an organization, it can be used to display some information about issues or pull requests extracted from the repositories they contain:

title
author
creation date
labels
URL to the issue or pull request

When a publicly readable user or organization contains a private repository, a user with access to this private repository can add an issue or pull request to the publicly available project. A user who was not allowed to read the private repository was able to see the information about the issue or pull request displayed in the project. When this same user visits the URL of the issue or pull request, they are denied access because they do not have the required permissions.

The vulnerable web endpoints were fixed and tests written to verify the fix is effective.

Forgejo gives advance warning of security releases

Similar to what is done when a Go release contains a security fix, Forgejo publishes advance warning of security releases. They do not reveal the details of the vulnerability but will allow Forgejo admins to plan ahead and better secure their instance. Anyone can watch the dedicated tracker or subscribe to the RSS feed.

Third parties may also get more information ahead of time when they agree to comply with the Forgejo Security Policy.

Contribute to Forgejo

If you have any feedback or suggestions for Forgejo, we'd love to hear from you! Open an issue on our issue tracker for feature requests or bug reports. You can also find us on the Fediverse, or drop by our Matrix space (main chat room) to say hi!

Forgejo v10.0 is available

Thu, 16 Jan 2025 00:00:00 GMT

Forgejo v10.0 was released 16 January 2025. You will find a short selection of the changes it introduces below and a complete list in the release notes.

This release marks the end of life for the previous stable version v9. The LTS series Forgejo v7 is still supported until 16 July 2025. Forgejo v10.0 will be supported until 16 April 2025, when Forgejo v11.0 is published. Admins of Forgejo instances with version v9 are recommended to prepare for an upgrade in time so that applying potential future security patches does not involve a major upgrade.

Summary

Forgejo v10.0 is the last version to allow a transparent upgrade from Gitea v1.22 or lower. In 2023 Forgejo was a soft fork, a set of patches maintained by the Forgejo community on top of Gitea. Early 2024 it became a hard fork and the codebases started to diverge. Forgejo and Gitea are now effectively different codebases although they share the same history back from the early days of Gogs.

If you are running Gitea v1.22 or lower and consider migrating to Forgejo long after v10.0 was published, it will still be possible, provided you upgrade to Forgejo v10.0 first and then upgrade to a newer Forgejo version. This will be a two steps upgrade instead of a single step.

New features

Below is short selection of the most notable changes. The complete list is available in the release notes.

PR: Rework the new repository dialog.
PR: Git notes can be modified via the API or the UI.
PR: Add button to create Markdown table.
PR: If you select a portion of a comment and use the 'Quote reply' feature in the context menu, only that portion will be quoted. The markdown syntax is preserved.
PR: Add link to show all issues and pull requests.
PR: Highlight user mention in comments and commit messages.
PR & PR: Add a "summary card" to issues, PRs, repositories and releases for consumption by OpenGraph clients.
PR: Filepath filter for code search.
PR: Add links to commit lists in contributors graph page.
PR: Add search to releases page.
PR: Migrate TOTP secrets to keying.
PR: When bleve is used for issue search, a fuzzy search now applies to each word instead of all of them, as if they were a phrase. For instance, searching for activitypub spam moderation previously returned no result in Forgejo discussions and now returns the relevant issues. If the search results are too broad, or for searching exact phrases prefer using an exact search. Sorting by newest is still available as a non default option under Sort. The query was also reworked to improve performances. It makes a significant difference for large instances such as Codeberg.
PR: Improve performance of notifications page for MySQL.

Hardened TOTP secrets

The TOTP secrets were stored using the secret module. They now use the keying module which is easier to use and relies on better practices to store secrets in a databases.

The keying module tries to solve two problems, the lack of key separation and the lack of AEAD being used for encryption. The secret module doesn't provide this and is hard to adjust to provide this functionality.

For encryption, the additional data is now a parameter that can be used, as the underlying primitive is an AEAD construction. This allows for context binding to happen and can be seen as defense-in-depth; it ensures that if a value X is encrypted for context Y (e.g. ID=3, Column="private_key") it will only decrypt if that context Y is also given in the Decrypt function. This makes a confused deputy attack harder to exploit.

Gitea compatibility

Forgejo v10.0 has automated upgrade tests from Gitea v1.22 to Forgejo v10.0.

An instance running Gitea versions up to v1.21 can be upgraded to Forgejo v7.0 or v8.0
An instance running Gitea v1.22 can be upgraded to Forgejo v8.0, v9.0 or v10.0

Future Forgejo versions will not support upgrades from Gitea instances running version v1.23 or above. Read more about Gitea compatibility and upgrades in the dedicated blog post.

Note on some harmless warnings

You may see migration warnings (and in some cases errors) when Forgejo starts. Most of them can be ignored as long as they do not prevent the instance from starting. However, they are confusing and you may want to get rid of them. More information can be found about that in the corresponding issue, as well as instructions to resolve them. If in doubt, do not hesitate to ask for advice.

Release schedule and Long Term Support

Version	Release date	End Of Life
7.0 (LTS)	23 April 2024	16 July 2025
9.0	16 October 2024	16 January 2025
10.0	16 January 2025	16 April 2025
11.0 (LTS)	16 April 2025	15 July 2026

10.0-test daily releases

Releases are built daily from the latest changes found in the v10.0/forgejo development branch. They are deployed to the https://v10.next.forgejo.org instance for manual verification in case a bug fix is of particular interest ahead of the next patch release. It can also be installed locally with:

OCI images: root and rootless
Binaries

Their names are staying the same but they are replaced by new builds every day.

Localization

This release contains the latest translation updates from the project on Codeberg Translate. They include a significant number of new translations and improvements to many languages, with particularly large refactors in Latvian and Simplified Chinese.

A new language has been made available: Low German (Plattdüütsch). It is already fully completed, only proofreading remains.

A new convenient feature has been added which allows to easily identify translation keys in the interface by simply appending lang=dummy to the URL parameters. It is also useful to quickly look up the UI template within the source code.

Get Forgejo v10.0

See the download page for instructions on how to install Forgejo, and read the release notes for more information.

Upgrading

Carefully read the Breaking bug fixes section of the release notes.

The actual upgrade process is as simple as replacing the binary or container image with the corresponding Forgejo binary or container image. If you're using the container images, you can use the 10.0 tag to stay up to date with the latest 10.0.Y patch release automatically.

Make sure to check the Forgejo upgrade documentation for recommendations on how to properly backup your instance before the upgrade.

Contribute to Forgejo

Donate

Thank you for using Forgejo and considering a donation, in case your financial situation allows you to.

Forgejo monthly report - December 2024

Sun, 05 Jan 2025 00:00:00 GMT

We wish all contributors, Forgejo users and interested followers all the best for 2025, especially for the projects you develop on Forgejo.

Welcome to Forgejo

It makes us very happy to hear from so many people who are migrating from various services to Forgejo, often based on their new year's resolutions. We are looking forward to see you as active members in our community and appreciate your feedback as new users.

We are pleased to read that the Fedora project is going to use Forgejo, and we are excited to improve the software and project in mutual collaboration. Some Forgejo contributors have met Fedora community members at FOSDEM 2024 and we are looking forward to a nice long-term partnership.

Visual testing

Decent test coverage to guard against bugs and regressions is an important goal of the Forgejo maintainers. However, testing the user-visible frontend is often challenging. In recent months, a lot of browser tests have been written using Playwright (also see the recent monthly reports) to test the behaviour of Forgejo as seen by a user.

Now, the tests are additionally used to create and compare screenshots to enable visual regression testing. The screenshots are managed in a separate repository to keep the size of the Forgejo repository low.

The screenshots are compared against previous state to see if pixel's match exactly. If they don't, a contributor reviews if the difference is expected (e.g. due to an improvement), acceptable (e.g. a minor side effect due to a change) or poses an issue. A few minor issues and regressions have already been discovered and fixed with the help of the screenshots.

This workflow is more efficient than manually clicking through Forgejo's UI, because test coverage is guaranteed and measurable. It is more accurate than human vision alone. The only remaining task is verifying the few changed pages.

Development work

There are only two weeks to go before the v10 Forgejo release (scheduled for January 15, see the release schedule). If you want to help make the release a great success, please finish translations and optionally test the release early and report issues.

Numerous improvements have made it into the release in December, such as searching in a subpath of your repo, performance improvements for notifications and new repo dialog, OpenGraph previews for repositories and releases and more.

Several forms have been reworked to make use of the new forms styleguide. They have improved consistency and accessibility and user experience was slightly improved. You will be available to enjoy a simplified new repo dialog and adjusted profile settings in the next release, and more to come.

Please report any accessibility issues and minor inconvenience to either the issue tracker or Mastodon.

Releases

The Forgejo release process is documented as a checklist of actions to be performed by a member of the release team (see for instance the checklist for the 9.0.2 patch release or the checklist for the 9.0.0 major release).

Work started last month to automate most of the tasks. In a nutshell, the new release manager creates a list of tasks for a given release (it is different for a major release or a patch release). Each task is an issue in a dedicated Forgejo repository that was created for this purpose only.

The description of the issue (such as cutting a branch) explains what is going to be done automatically and what is the responsibility of the release team member (such as writing a blog post). By placing the run label on the issue, the release manager will carry out the task. In dry run mode it shows what would be done and documents it as a comment on the issue. The gory details are found in the output of the workflow, for debugging purposes.

The Forgejo v9.0.3 release was published using the release manager for the first time. It was a bumpy experience that uncovered a dozen bugs and even brought down code.forgejo.org during 15 minutes. Although the individual actions involved in the process are tested (see this example test workflow), bugs happen.

The Forgejo helm chart has seen two security updates.

Infrastructure

The migration of the Forgejo infrastructure to a k8s cluster that was completed last month can be used to improve the availability of the default instance from which actions are downloaded.

As of Forgejo v10.0 actions will be downloaded from https://data.forgejo.org, separating read-only assets that can easily be replicated and updated with a delay from the repositories where development happen such as end-to-end tests or the Forgejo runner.

Dependency management

Almost a year ago, a large scale effort was undertaken to improve dependency management on the Forgejo repository itself.

It was generalized to all Forgejo instances and repositories involved in the making of Forgejo. To keep it dry, a shared configuration is used. A number of repositories where dependencies were lagging behind were updated (the setup-forgejo action is one of many such updates).

Sustainability

Two ongoing grants have ended this month, the first one on December 1st and the second on December 31rd. We are thankful for the NLnet foundation for the great funding opportunity.

The funds compensated the work of Forgejo contributors with a total € 40.250. Generously, some contributors have decided to send their request for payment in the name of Codeberg e.V., which has received a total of € 32.750 from the NLnet grants, multiplying the effect of the grant by allowing the money to be re-invested to sustain the development of Forgejo.

Unfortunately, some portion of the grant was not claimed and expired, mostly because contributors were not available to complete the work they initially planned to do.

During a sustainability meeting on December 28, ideas and plans for next funding opportunities were exchanged. The goal is to complete a list of potential milestones within two weeks and propose a workplan to NLnet.

If financial compensation would allow you to contribute to Forgejo, we are interested in hearing from you. You can join the chat of the sustainability team on Matrix: #forgejo-sustainability:matrix.org.

Acknowledgements to projects that improve Forgejo

Forgejo exists thanks to thousands of contributors in the free software ecosystem. They maintain libraries and development tools that save the Forgejo contributors time and effort. Their impact on the codebase is significant, but it is often only visible in case bugs originate from these upstream developers.

In the future, we would like to add explicit acknowledgements to the contributors of the ecosystem that makes Forgejo what it is, and we appreciate help and pointers on how to efficiently do this.

There is no secrecy about our relation to Gitea, the project we forked two years ago, and we have applied due diligence and best practices to retain authorship information and references for code that we imported from the Gitea open source codebase.

Nevertheless, we have been accused of stealing code from Gitea, combined with a threat for legal action by a Gitea contributor and CommitGO/Gitea Ltd. shareholder. Apparently, the primary issue was confusion about the cherry-picks, commit signatures as well as the exact definition of "hard fork". Note that we rely on the default behaviour of Git when used with GPG keys. Since not everyone involved in the thread can be expected to be familiar with the characteristics of Git, we explained the behaviour.

In short: git cherry-pick retains the authorship of the commit as the "author" metadata, and signs the commit to preserve information about who created the cherry-pick. Signing the commits with GPG keys of Gitea contributors is obviously not possible, because only they have access to their private keys and sharing them would undermine the security benefits of the signatures.

To clear up any confusion, we have reworded certain parts of our website and explain the current cherry-picking process once more. Nearly every week, a Forgejo contributor uses a tool to categorize activity in Gitea and create a pull request that contains references to the origin of contributions and an assessment of relevancy for Forgejo.

A small subset of contributions is picked because they are relevant to Forgejo and save effort for the Forgejo contributors. Some more commits are marked for a closer look, for instance because test coverage is not sufficient for a merge in Forgejo, because they require more discussion and review for usability, accessibility and design, or because there is a conflict that needs resolution (we refer to this as "porting"). Many commits are skipped for various reasons, e.g. because they have already been implemented in Forgejo before, because they are specific to Gitea's workflows, or otherwise are not agreed on by Forgejo reviewers. For an impression, the stats for the last weekly cherry-pick look like this:

Between gitea@35c86af164 and gitea@a92f5057ae, 41 commits have been reviewed. We picked 4, skipped 31 (of which 6 were already in Forgejo!), and decided to port 6.

After the set of cherry-picks has been reviewed and approved, the commits are merged so that they retain authorship information about the Gitea contributors.

Over time, the two codebases will diverge further, and this procedure will become unfeasible some day. While contributors are still free to port individual changes from Gitea, it will stop being a routine task.

We hope this reduces confusion about our current and expected future workflow. Please let us know in case there are any questions left or suggestions from your side.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

Gitea 1.22 is the last version to allow a transparent upgrade to Forgejo

Wed, 18 Dec 2024 00:00:00 GMT

The Forgejo v10.0.0 release to be published 15 January 2025 supports upgrade from Gitea instances up to version v1.22 included. Future Forgejo versions will not support upgrades from Gitea instances running version v1.23 or above.

How will this impact me?

If you are running a Gitea instance and would like to upgrade your instance, here are your options:

Gitea versions up to v1.21 can be upgraded to Forgejo v7.0 (Long Term Support) or higher, up to v10.0 included
Gitea v1.22 can be upgraded to Forgejo v8.0 or higher, up to v10.0 included

Upgrade from Gitea to Forgejo versions higher than v10.0 is a two step process:

Migrate Gitea to Forgejo (e.g. Gitea v1.21 to Forgejo v7.0.10)
Upgrade Forgejo to the desired version (e.g. Forgejo v7.0.10 to Forgejo v11.0.5)

If you are running Gitea 1.23 or higher, it may be possible to upgrade to Forgejo v8.0.0 or higher, if you are ready to manually modify the database and move the data around. You can get help in attempting that but you should not expect more than a best effort.

If you would like to move data from a Gitea instance that cannot be upgraded to Forgejo, you can move repositories one-by-one using the in-app migration tool. It will continue to work for as long as the Gitea API remains stable.

Why is this happening?

In 2023 Forgejo was a soft fork, a set of patches maintained by the Forgejo community on top of Gitea. In 2024 it became a hard fork and the codebases started to diverge.

A very significant effort was made by Forgejo contributors to keep both codebases compatible and share the bug fixes and features.

Tooling was developed to watch over the Gitea codebase.
Weekly cherry-pick sessions were organized to discuss Gitea commits and evaluate their relevance in Forgejo.

In the beginning git cherry-pick was possible without conflict most of the time. But it is less often the case because large scale features were implemented in Forgejo such as quotas and Gitea engaged in dozens of refactors.

Forgejo and Gitea are now effectively different codebases although they share the same history back from the early days of Gogs. Features and bug fixes are a source of inspiration to be ported manually and no longer material for a clean cherry-pick.

Why now?

Most hard fork do not invest so much time and effort to keep in sync with the original codebase. And for a reason: it turns out to not be very exciting. But it was very beneficial while it lasted: dozens of bug fixes landed in Forgejo and allowed contributors to focus on more interesting matters.

A year ago it was impossible to guess how long it would take for Forgejo to become incompatible with Gitea. It was inevitable but it could have happened a lot sooner.

Forgejo is incompatible with Gitea v1.23 for instance because:

Modifications in the Gitea database are not in the Forgejo database (e.g. indices in actions, priority for protected branches)
Some Gitea features have a completely different implementation in Forgejo (e.g. admin branch protection)
Some sub systems have been re-architectured deeply in Forgejo or Gitea (e.g. webhooks in Forgejo)

Such differences were worked on as part of the weekly chore to keep the two codebases close to each other and ensure a upgrade from Gitea to Forgejo was a seamless experience. As can be expected, the difficulty increases in direct proportion of the drift between the two codebases.

It reached a point where the benefits are no longer worth the effort.

Would Gitea be willing to help?

If Gitea was a community driven project, this may have been possible. But the reason for Forgejo to exist was disagreement about the governance of the project, and naturally this situation has not improved. By now, Gitea is Open Core and several attempts by the Forgejo community to upstream changes have lead to tensions.

In the past year Gitea did not make any effort to keep both codebases compatible or help Forgejo. It actually did the exact opposite a number of times, re-implementing bug fixes or features shortly after they were published in Forgejo. In doing so, Gitea has intentionally or carelessly precipitated the divergence.

Forgejo monthly report - November 2024

Thu, 05 Dec 2024 00:00:00 GMT

Forgejo releases

The Forgejo v9.0.2 and v7.0.11 security releases were published. They have an unprecedented number of security fixes, some of which took months to mature. The difficulty in working on multiple security fixes is that they need to be combined and verified before the release date, to minimize the chances that issues are discovered at the last minute, on the day of the release. The release team has set up the tools to work with the security team in these preparations. In a nutshell it duplicates the Forgejo development setup but strips out the workflows that are not useful in this context.

The Forgejo release process grew and transformed significantly and frequently to adapt to a moving landscape. The two most significant events were the switch from Woodpecker CI to Forgejo Actions as soon as it was released early 2023. And earlier this year, Forgejo became independent of Gitea, which led to the definition of a new release cycle and the first instance of a long term support release.

It stabilized over the past six months and that allowed for the emergence of tools with the goal automate what is still currently a largely manual and long checklist. The checklist for the upcoming v10.0 release tracks their progress. The first two developments are:

A machine readable release schedule.
An action to cut branches, set branch protections and manage backport labels to be used by the documentation repository and later by the Forgejo repository itself.

Forgejo Actions

The security audit began mid November and some of its findings were fixed. It led to the publication of multiple releases from 4.0.1 to 5.0.2. They also include better control for verbosity and graceful handling of some corner cases that would crash the runner.

Codeberg started to offer hosted Forgejo Actions, the service is considered open alpha. If you didn't get to trying Forgejo Actions with a self-hosted runner yet, you can now give it a try with the hosted runner, in case your projects meet the requirements of Codeberg.org.

The extensive usage of Forgejo Actions for the development of Forgejo itself reveals bugs in edge cases from time to time. A workflow which checks labels in a pull request as a merge condition was added, temporarily reverted, and re-added after relevant bugs were addressed. Several related issues were discovered and fixed, and working with label events in pull requests can now be considered more mature in Forgejo Actions.

Helm chart

Some OpenShift compatibility on chart version v10.1 and bug fix releases for v7 and v10 for the Forgejo security releases.

https://code.forgejo.org/forgejo-helm/forgejo-helm/releases

Accessibility

Improvements to colorblind themes were implemented. There is an ongoing discussion about this topic. If you rely on Forgejo's colorblind themes, or would like to but can't use the themes, consider getting involved in the discussion post.

Localization

Two new members have joined the localization team with the intention of maintaining Latvian and Low German translations.

The work on the new translation for Low German started in October and the translation is now completed, only proofreading remains. This language will be available to users in Forgejo v10 and can already be tested out on the dev instance.

A new script was created to process translation files. It allows to perform backporting of translations safely which was done for v9 as well as other maintenance chores such as removal of orphan strings and duplicates.

Infrastructure

The k8s cluster bootstrapped in October has matured and is now in production, hosting all services that previously were using ad-hoc scripts. It was initially motivated to improve the availability of the Forgejo resources in the wake of a downtime that disrupted https://code.forgejo.org during 10 hours in September. For this migration two new EX44 machines (one in Germany, the other in Finland) were setup and replace a larger EX101 machine.

Another benefit of the k8s cluster is that it does not require manual intervention, it is driven by the repository that defines it. This will allow, for instance, for a workflow to dynamically and automatically provision and modify test instances (https://v7.next.forgejo.org, https://v10.next.forgejo.org, etc.) based on the machine readable release schedule.

Renovate

Some more repos adopted to use automated Renovate updates.

https://code.forgejo.org/forgejo-contrib/forgejo-renovate/src/branch/main/src/config.json#L8

Testing efficiency

Careful testing is an important goal within the Forgejo community and contributions to Forgejo need reasonable test coverage in order to be accepted.

Migration tests for Gitea and GitHub existed, but were not yet run. They have now been enabled, improving test coverage for migrations across forges.

Running test pipelines for a project at Forgejo's scale has significant costs, not only financially but also ecologically. Reducing energy consumption as well as feedback time is important.

Several contributors picked up the task and made the journey to improve the situation. From improvements increasing quality and speed to refactors to improve reliability and avoid unnecessary retries, this month was very active with CI/CD and test optimizations.

Several PRs like this one successively moved a lot of test data into memory, not only speeding up the tests but also reducing writes and thus disk wear on the hardware. Finally, even some database parameters were tuned for MySQL and PostgreSQL.

There are more ideas on how to continue towards sustainable and efficient CI/CD.

Performance at scale

During moments of extreme load at Codeberg, some insights about slow database queries have been shared to the Forgejo community. Improvements were quickly integrated in the next version of Forgejo, scheduled for publication in January 2025.

Especially subqueries that use WHERE ... IN instead of JOIN can lead to poor performance with MariaDB, as can be seen on Codeberg. Small contributions in this area, such as this simple change can bring significant improvement. After deploying this change to Codeberg, the "New repository" page now loads significantly faster (down from up to 3 seconds back into a millisecond range). More contributions in this area are more than welcome.

Stability and database corruption at Codeberg

In some cases, Forgejo's database can get inconsistent, and there is a command-line tool (the "doctor") to perform checks and fix the database. Especially on busy instances, doing this regularly is recommended to clean stale data and discover issues.

However, while running this on Codeberg, a corruption issue was discovered and fixed. The consistency checker incorrectly deleted global OAuth2 applications, because they do not have a user assigned.

Users of global OAuth2 applications are advised not to run the doctor until the fix is released in Forgejo v9.0.3.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo monthly report - October 2024

Thu, 31 Oct 2024 00:00:00 GMT

Two years - a recap

In October 2022 Forgejo was announced in reaction to the takeover of Gitea. After a two months of preparation, the first release was published and Codeberg announced using it because "it provides Codeberg with an essential feature: trust".

The security team got quite busy soon and published multiple releases. The release team was also able to deliver but a mistake was made. This was the first occasion for Forgejo to show that problems are explained transparently and their impact articulated clearly. The integrated CI, Forgejo Actions, was announced and started to be used by Forgejo itself very early on.

In February 2023 someone new (who wasn’t a contributor that the project is relying on) joined the chat and issue tracker, spoke repeatedly in ways that was hurtful/painful to Forgejo community members, and did not seem to have capacity to speak more sensitively, despite offers for support and repeated requests. It distracted community members from productive and important work on governance, strategy and development. Some community members went silent, others were on edge. The moderation process was created during these challenging times. It took months for the community to heal.

In search for long term sustainability, the first grant application was sent. It was awarded and the funds allowed Codeberg to hire developers early 2024. It was not perfectly managed and in December 2024 a significant part of the funds will be returned because they were not spent. It currently is the priority of the sustainability team established in August 2024.

After weeks of discussions, a decision was made to welcome copyleft contributions in Forgejo in June 2023. The Forgejo decision making process requires that all concerns are heard and answered before a decision is final. It takes long but is also a key to being inclusive. It became a reality a year later, in August 2024.

Forgejo federation is and will always be the highest priority of the Forgejo project. Every month, since the beginning, updates on its progress are published. It is still not in a usable state, two years later, and that has caused some frustration but the work continues.

In August 2023 a regression was discovered to cause data loss. A lot of work went into fixing it and publishing documentation explaining how to recover. It was caused by a refactor that was not properly tested and was one of the main motivation to require that every pull request merged in Forgejo is tested.

In the last months of 2023, Forgejo contributors kept improving while rebasing all the changes on top of the Gitea codebase. However, when Gitea Cloud was announced in December 2023 and after some investigation, it became clear that Gitea turned Open Core.

In January 2024, the Forgejo localization team came into existence, in anticipation of a hard fork. Before that, the Forgejo translations depended on Gitea translations which are trapped in a proprietary service. The initial localization team covered Arabic, Dutch, French, Russian, Greek and German and kept growing since.

Forgejo was ready for such an event and declared its intention to become a hard fork, separating itself from Gitea even further. Just as for the decision to welcome copyleft contributions, this required weeks of (sometime intense) discussions. And it also took weeks of work to be implemented in March 2023. Coincidentally the Open Core turn of Gitea was confirmed when a the first proprietary version of Gitea was announced around the same time.

There was a sense of liberation when the hard fork began: it was possible to write code incompatible with the Gitea codebase! But there was also a price to pay: features and bug fixes relying on such code could not be shared with Gitea. It would have been easy to be carried away and get stuck with not enough contributors to maintain a codebase that diverged too quickly. To mitigate that risk dependency management tooling and a weekly observation of Gitea activity was organized and is still in place.

The Forgejo v9.0 release that was published in October 2024 is the third major release after the hard fork. It includes a feature that would have never been possible before (quotas) because it requires architectural changes conflicting with the Gitea codebase. Forgejo v7 is a Long Term Support release, the first of its kind, supported during a year instead of three months. It is another benefit of the hard fork, made possible because Forgejo is no longer bound to the Gitea release cycle.

In these past two years Forgejo matured and transformed into an independent project, with a solid user base and a lively community of contributors. It involved a lot of coding and other time consuming technical work. But it was first and foremost a human adventure, with its share of plot twists and drama.

Forgejo releases

On 16 October Forgejo v9.0 was published. It is the first version to be released under a copyleft license. Codeberg was upgraded a week later. Regressions were discovered and fixed. Some of them were only noticeable visually (diagrams not showing labels or the displayed name of archives). Another was about the container image size that grew significantly (180MB for v9.0.0) and was reduced to 70MB for v9.0.1, back to the size of the Forgejo v7 images.

On 28 October Forgejo v9.0.1 was published and fixes those regressions. It also contains two security fixes that were backported and published as Forgejo v7.0.10, the Long Term Support version.

These releases are the first to reflect the new Forgejo lifecycle. Before Long Term Release support existed, only v9 and v8 would have been supported, i.e. the last two major versions. But since v7 is supported until July 2025, the supported versions are now v9 and v7, i.e. the latest version and the long term support version.

User Research

The user research team conducted a survey regarding the repository settings during two weeks in October. It encouraged participation by showing banners to users of Codeberg in the repository section, linking to an external survey on Cryptpad.

There have been 118 submissions and the analysis is still ongoing, but there is already valuable feedback among the reviewed feedback. Thanks to all the participants!

There has been a rather spontaneous interview regarding accessibility with a Codeberg user. They reported a serious issue with their screen reader, which we didn't yet manage to reproduce (even after a contributor set up a test environment with the proprietary operating system and the screen reader). Investigation of this issue currently has high priority and we hope to fix the issues as soon as possible.

Security Policy

Forgejo published its security policy to clarify communication and collaboration of the Forgejo security team with external parties such as libraries, security researchers and users.

Advance notice of security releases are available publicly. They do not contain specific information until the day of the release and are meant to help Forgejo admin plan for an upgrade.

Gitea was given a detailed description of the security issues fixed in the the v9.0.1 and v7.0.10 releases in advance, as well as a patch waiving copyright to fix them. From now on, any third party willing to receive such details in advance is required to explicitly agree to comply with the security policy.

Helm chart

A new major version, 10.0.0 was published. It updates the Forgejo docker tag to v9.

The Forgejo helm chart had security patch updates, in both v7 and v10. Helm chart v7.1.3 and v10.0.1 are the latest.

Localization

The translation hackathon (translathon) organized by Codeberg this month resulted in many new contributors joining and making thousands of additions and improvements.

In total, 57 people contributed to the translations this month, which is significantly more than any previous month.

A new script was added to process the localization files and verify that they contain only valid HTML insertions that follow the strictly defined rules. This should make it nearly impossible to insert malicious HTML.

Due to project's legacy, the localization strings traditionally were able to contain any arbitrary HTML code and often had hardcoded links and other aging code. The addition of this script reduces the number of attack vectors on Forgejo's codebase and improves it's maintainability. Fortunately, there have been no security incidents caused by this flaw.

Infrastructure

A new k8s cluster was created and planned to replace the current setup. Instead of ad-hoc scripts, conventions and associated documentation, it relies on a declarative description that updates the cluster when a commit is pushed to the repository.

It went through a few disaster recovery tests and is now in production, hosting https://next.forgejo.org and https://v7.next.forgejo.org, ready to welcome other Forgejo instances.

The motivation for creating this new cluster is to improve the availability of https://code.forgejo.org in the wake of last month downtime. But it also significantly improves automation and reduces the technical debt. It will obsolete the ad-hoc scripts (wakeup-on-logs, shell scripts, ...), conventions and documentation.

A k8s cluster is more attractive to Forgejo contributors who are willing to improve and maintain the infrastructure. They are in familiar territory if they already know k8s and do not need to learn new tools. They can start contributing with pull requests to the repository describing the cluster and eventually apply to become a member of the devops team when they gained enough trust.

It is a lot more work to learn k8s from scratch than it is to learn the current ad-hoc system from scratch. From that point of view, this transformation does not make it easier to find volunteers willing to participate. However, there are a lot of devops who already learned k8s while nobody knows the current ad-hoc system. They do not need to learn k8s and can jump right in.

Sustainability

The beneficiaries of the NLnet grant application sent in April 2024 are no longer available. A call for participation was posted to find Forgejo contributors willing to participate.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo v9.0 is available

Wed, 16 Oct 2024 00:00:00 GMT

Forgejo v9.0 was released 16 October 2024. You will find a short selection of the changes it introduces below and a complete list in the release notes.

If stability is more important than new features, consider using Forgejo v7.0 instead: it is a Long Term Support release that will receive bug fixes until 16 July 2025. Forgejo v9.0 will be supported until 15 January 2025, when Forgejo v10.0 is published.

Summary

Forgejo v9.0 is the first version to be released under a copyleft license, after a year of discussions. Among the motivations for this change is the realization that a pattern emerged over the years, exemplified by Redis, CockroachDB, Terraform and many others. They turned proprietary because people chose their own financial gain over the interest of the general public. Forgejo admins no longer have to worry about this sword of Damocles: relicensing it as a proprietary software is not allowed.

The removal of the go-git backend is part of a larger effort to make Forgejo easier to maintain, more robust and even smaller than it already is (~100MB). When presented with go-git as an alternative to Git, a Forgejo admin may overlook that it has less features and a history of corrupting repositories. It would have been possible to work on documentation and new tests to ensure administrators do not run into these pitfalls, but the effort would have been out of proportion compared to the benefits it provides.

The Forgejo localization community was created early 2024 with the ambitious goal of gaining enough momentum to sustain a long term effort. A daunting task considering there are over 5,000 strings to translate, verify and improve. There has been many calls for help in the past and the community keeps growing steadily. Fortunately, the translation hackathon (translathon) organized by Codeberg in October was exceptional. It attracted an unprecedented number of participants who improved or created thousands of translations.

New features

Below is short selection of the most notable changes. The complete list is available in the release notes.

PR: Added the foundations of a flexible, configurable quota system.
PR: Allow push mirrors to use an SSH key as the authentication method for the mirroring action instead of using user:password authentication. The SSH keypair is created by Forgejo and the destination repository must be configured with the public key to allow for push over SSH.
PR: A release asset can be a URL instead of a file.
PR: Accessibility keyboard support for test actions.
PR (backported): "Assign to me" button on Pull Requests and Issues.
PR: Support grouping by any path for arch package.
PR: Add signature support for the RPM module.
PR: commit The actions logs older than [actions].LOG_RETENTION_DAYS days are removed (the default is 365).
PR: commit issue Templates: add option to have dropdown printed list.
PR: Logs journald integration.
PR: Refactor repository migration items.

Copyleft

The impact of the license change has been carefully considered with regard to the variety of usages of Forgejo. Someone might have chosen to avoid copyleft software, for example because it is discouraged in a company. However, Forgejo depends on Git, one of the most successful pieces of copyleft software. Both Forgejo and Git must be used together, either as individual binaries or bundled into the official container images. The license of Git is GNU GPL v2, another version of the same copyleft license.

The majority of Forgejo's codebase is still MIT-licensed, but it is expected that an increasing number of files will switch to GNU GPL v3+ over time. With the notable exception of the API swagger file that is and will stay MIT to clarify that the intent of the Forgejo authors is that it is used for interoperability with no restriction. It is not an original work and enforcing copyright on that file would probably be difficult anyway.

Quotas

Forgejo got early support for a soft-quota system that can protect your server from high disk usage due to abuse or user mistakes. This feature is still in development. If you will try to use it, consider sending us feedback via a discussion, or the Matrix channels.

Forgejo has chosen to use a "soft" quota implementation. It means that Forgejo checks the quota usage only before an action is executed, but it will allow a started action to complete.

In some cases (like pushing to Git repositories), it is hard to estimate the exact new size, because it depends on how much data is available and how much we can benefit from compression. As a result, it is possible to exceed the quota if the operation was started before the quota was used up. After the quota is exceeded, new operations that would increase the quota won't be possible.

Furthermore, there is currently little support for early prevention of operations in the UI: The handling of, for example, web operations that are denied later is not yet optimal.

Read more in the Soft-Quota page of the documentation.

The multi-architecture OCI leak is fixed

When a multi-architecture container image is pushed to the Forgejo registry, the same tag is used but refers to different images. This is what Forgejo itself relies on to provide either arm64 or amd64 depending on the platform (e.g. docker pull codeberg.org/forgejo/forgejo:7).

This is implemented with an image index which points to image manifests. This level of indirection was unfortunately not taken into account when cleaning up dangling blobs. When a multi-architecture image was either deleted from the web interface or overridden by pushing new images with the same tag, the blobs were never deleted. This bug has been present in Forgejo since the beginning and went unnoticed for a long time, presumably because multi-architecture images are uncommon.

Forgejo will remove dangling blobs when it starts as well as in the existing daily container image cleanup. This will show in the logs with when looking for grep -i CleanupSHA256:

2024/10/15 00:00:00 ...er/cleanup_sha256.go:106:cleanupSHA256() [I] Nothing to cleanup
2024/10/15 00:00:00 ...er/cleanup_sha256.go:29:CleanupSHA256() [I] Finished to cleanup dangling images with a sha256:* version

The time required for the cleanup to complete should be under a minute, even if ten of thousands of blobs were leaked. It is however recommended to give it a try using a backup of the Forgejo instance to be sure. For instance when https://code.forgejo.org was upgraded, it cleaned up a few thousand dangling blobs for a total of around 50GB within less than 15 seconds. To accommodate large instances such as Codeberg, blobs are cleaned up 500 at a time.

Removal of go-git support

Forgejo used to have 2 Git backends: the normal git and go-git which is a Git implementation in pure Go. This the benefit of being a little bit faster than Git on Windows.

Supporting go-git would mean holding Forgejo back. Every Git Feature that Forgejo wants to use also needs to be implemented in go-git. For example: setting git notes in the Web UI is currently not possible in go-git. In addition go-git may lead to data loss and repository corruption (one example). It is not widely used and does not have extensive testing (see the latest example of such corruption).

For these reasons, go-git was removed from the codebase. It only affects users who built Forgejo manually using TAGS=gogit, which no longer has any effect. This removal only happened in the development branch and not in the existing stable Forgejo branches, up to v8.0/forgejo included.

Transparent removal of Couchbase

Using Couchbase as a session provider was removed. This is not a breaking change because it will transparently fallback to the file provider. The rationale for removing Couchbase support is that it is not free software and therefore cannot be tested in Forgejo and neither should be supported.

Gitea compatibility

Forgejo v9.0 has automated upgrade tests from Gitea v1.22 to Forgejo v9.0.

An instance running Gitea versions up to v1.21 can be upgraded to Forgejo v7.0 or v8.0
An instance running Gitea v1.22 can be upgraded to Forgejo v8.0 or Forgejo v9.0

Release schedule and Long Term Support

Date	Version	Release date	End Of Life
2024 Q1	7.0.0	23 April 2024	16 July 2025
2024 Q2	8.0.0	30 July 2024	16 October 2024
2024 Q3	9.0.0	16 October 2024	15 January 2025
2025 Q1	10.0.0	15 January 2025	16 April 2025

9.0-test daily releases

Releases are built daily from the latest changes found in the v9.0/forgejo development branch. They are deployed to the https://v9.next.forgejo.org instance for manual verification in case a bug fix is of particular interest ahead of the next patch release. It can also be installed locally with:

OCI images: root and rootless
Binaries

Their names are staying the same but they are replaced by new builds every day.

Localization

This release contains many translation additions and improvements done by contributors on Codeberg Translate, and numerous improvements to the UX and translatability of English locale.

Translation updates and some improvements of English locale were also ported to v7.0 where there was no risk of regressions.

The translation hackathon (translathon) organized by Codeberg in October resulted in many new contributors joining and making thousands of additions and improvements.

Get Forgejo v9.0

See the download page for instructions on how to install Forgejo, and read the release notes for more information.

Upgrading

Carefully read the breaking changes section of the release notes.

The actual upgrade process is as simple as replacing the binary or container image with the corresponding Forgejo binary or container image. If you're using the container images, you can use the 9.0 tag to stay up to date with the latest 9.0.Y patch release automatically.

Make sure to check the Forgejo upgrade documentation for recommendations on how to properly backup your instance before the upgrade.

Contribute to Forgejo

Donate

Forgejo is proud to be funded transparently. Additionally it accept donations through Liberapay. It is also possible to donate to Codeberg e.V. in case the Liberapay option does not work out for you, and part of the funding is used to compensate for work on Forgejo.

Thank you for using Forgejo and considering a donation, in case your financial situation allows you to.

Forgejo monthly report - September 2024

Sun, 06 Oct 2024 00:00:00 GMT

Forgejo v9.0 release candidates

The first release candidates for Forgejo v9.0 was published 25 September and code.forgejo.org upgraded. A call for participation was published, asking for help with translations and testing.

A regression was discovered in the v9.0 release candidate that incorrectly deleted some of the images mirrored from the Docker hub. It disrupted the CI intermittently during 48h before a fix was published and deployed. The root cause was a bug in the cron task that cleanup dangling container images.

Forgejo Design process

Efforts on long-term improvements to Forgejo have been kept low in the past month, however there was a noteworthy exchange on moderation features in Forgejo. Initially, an idea was investigated to track reported content in a specific issue tracker, but the idea was discarded some time later due to the volume of spam issues on Codeberg, which probably requires a more efficient UI. The moderation features will not make it into Forgejo v9, but they will remain in the focus of design work.

Contributor documentation and test suite

By the end of August, a discussion emerged to improve Forgejo's testing infrastructure, making it more friendly to new developers.

Since the last monthly report, multiple improvements have been made:

The contributing resources in the documentation have been cleaned and updated, with the goal of encouraging more diverse contributions, sending a warm welcome to new contributors and clarifying the motivation and instructions for writing tests. If you did not yet contribute to Forgejo, now is a good time to get started and provide us with feedback.
The in-repo hints for testing have been deduplicated and updated to make getting started easier. And numerous smaller improvements have been made to the end-to-end test suite that uses real browsers to ensure actions in the Forgejo UI work as expected. They added and improved examples.

Using the improved test infrastructure, the frequency of new browser tests has increased a lot compared to recent months.

Helm chart

A new major version, 9.0.0 was published. It sets proper namespaces and allows override.

The Forgejo helm chart had many minor and patch updates, in both v7 and v8. Helm chart v7.1.2 and v8.2.3 are the latest.

Localization

A significant effort was made to backport translations to the LTS version (Forgejo v7.0). There was hope for new languages added in this version to reach better completion in its primary lifetime, but it is taking longer than expected. This and other considerations led to a proposal to do less backporting to old stable to prevent breakage and save time.

A very large change was ported from Gitea and is good for internationalization. But it was not easy to also preserve the existing strings and it could have broken a few non-English strings in Forgejo v9. Some translators caught the problem and it was luckily fixed in time.

The overall translation activity was about twice lower than last month, which was very active.

Forgejo Actions

The security audit bootstrapped last month has its own repository to track the work done as transparently as possible. A suitable pentester was found and the scope of the audit was determined during a call. A rough plan was drafted and approved by NLnet who is funding the audit. The work should begin in November 2024.

Optimizing CI pipelines

In order to ensure a high software quality, Forgejo (like most larger project) runs CI/CD pipelines that perform a series of automated checks on the source code, ensuring that contribution meet certain quality standards.

Running these pipelines consumes significant amount of energy and adds to the climate footprint of free/libre software development.

In a quest to make Forgejo more frugal in the use of computing in the development lifecycle, optimizations to the CI/CD pipelines have been considered and a part of the work was merged.

The optimizations include caching the playwright environment in a test image and improvements to the caching of Go dependencies that improves on the caching available from the setup-go action that spent 10x2 minutes per job creating compressed archives. The action is also available to other projects and a dedicated contribution to the Forgejo Actions ecosystem.

Infrastructure

On 9 September code.forgejo.org was down during 10 hours. It was overwhelmed by excessive crawling and the response time was so slow that it kept accumulating a backlog and answering every request with a timeout. On top of that it happened late at night and although it was trivially fixed by restarting Forgejo, it only happened the next morning.

This was the first significant downtime and impacted a number of Forgejo instances that are using Forgejo Actions hosted on code.forgejo.org. A number of measures were taken to prevent that from happening:

Rate-limiting is imposed on the most aggressive crawlers.
Exclusion rules were defined and added to robots.txt.
Members of the devops team are notified on their mobile when monitoring detects a problem.
An ad-hoc script was written to detect excessive timeouts during extended periods of time and automatically restart Forgejo if needed.

The script is a hack that must not stay. It proved useful a couple of times while working on strategies to reduce crawling to manageable levels. It still represents over 50% of the incoming requests but they do not impact the instance performances.

The long term solution, as code.forgejo.org audience grows, is to improve its availability. The test instances at v*.next.forgejo.org are already using Forgejo helm, each in a dedicated k3s cluster. A long lived k8s cluster is being deployed to use the same Forgejo helm so code.forgejo.org can be migrated there. The goal is for built-in health monitoring to automatically react to an unhealthy Forgejo instance and restart it using idiomatic k8s methods instead of an ad-hoc script.

There is no urgency for the k8s cluster to replace the LXC based infrastructure. But it will take some time to improve code.forgejo.org availability in this way and the works started right away so that it has a chance to be ready before the next incident happens.

Sustainability

A procedure for receiving payment from Codeberg on Forgejo work was documented and discussed. The details of the funds received and spent in 2024 were updated.

The progress of the ongoing grant was updated. It was extended until the end of 2024 and got an informal agreement to increase the funding by 10K€. The legal status of the donations in Europe was documented with an example based on a Freelance established in Portugal, with links to do the same for other European countries.

The progress of the federation grant was also updated and a request for payment drafted for 2,500€. The grant will expire 1 December 2024 and the unspent funds will be returned to NLnet where they can be used by other projects.

Questions were received from NLnet on the latest grant application and an answer sent which led to followup questions. Because of the required delay in answering those questions, the grant application was moved by a few months, to the next call.

The sustainability team elected its first member. They helped with following up with the current grants and document the progress made so far.

The relevance of creating a non profit exclusively dedicated to managing the Forgejo funds and governed by the Forgejo decision making process was discussed. A balance should be found between the burden of managing a new organization and the benefit of being more flexible than Codeberg. The current situation is problematic as a significant amount of the funds obtained in the past two years (in excess of 60,000€) will have to be returned when the grants expire by the end of 2024.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Help us in making Forgejo v9 a great release

Wed, 25 Sep 2024 00:00:00 GMT

We are looking forward to shipping the improvements we have made in the past months to all Forgejo users. Today, we have reached the next milestone in our release cycle, reaching a period of feature freeze to focus on fixing bugs. The release of Forgejo v9.0 is scheduled for 16 October 2024.

It is a good moment for you to help ensuring the next Forgejo release is a success. Thank you for your support!

Localization

With the feature freeze comes a period of less new strings to translate. Now is the best time to translate Forgejo into your language, we invite you to check out the localization guide and joining us on Weblate.

Localizing Forgejo helps more users around the world to get involved in free/libre software development, including end-users submitting bug reports and students who get in touch with Forgejo in schools.

Additionally, raising the completion status before the next release reduces the effort on our end to backport translations to existing Forgejo releases.

Join our localization effort today!

Using

If you can upgrade your Forgejo version to the latest state in the v9.0/forgejo branch, you can spot and report issues before other users do. Ensure you make a backup of your data, just in case.

We are looking forward to your feedback or bug reports. Test the upcoming version of Forgejo today!

Developing

If you always wanted to help developing for Forgejo, we appreciate your help in fixing bugs for the upcoming version.

Take a look at this list of bugs that might be "good first issue"s. Let us know if you are interested to take a look at any of them, and we'll be here to assist you completing them before the release date.

If you can spare more time, also take a look at other and new bug reports, try to reproduce them and diagnose the issues together with the team.

Donating

If you cannot spare some time right now, but still want to support Forgejo, consider setting up a donation to our Liberapay team or donating to Codeberg to enable other Forgejo developers to complete their work.

Get in touch

Forgejo monthly report - August 2024

Sat, 31 Aug 2024 00:00:00 GMT

It was decided more than a year ago and finally happened: Forgejo changed its license from MIT to GNU GPL v3+ and accepts contributions with a simple Developer Certificate of Origin. It is an additional guarantee that it will not drift away from Free Software and become Open Core like GitLab or Gitea.

Last month, the v8.0 release date was postponed multiple times because bugs were discovered at the last minute. This rather time consuming effort was rewarded by a smooth upgrade of Codeberg and other instances. The absence of problems allowed Forgejo contributors to focus on features and structural improvements: ActivityPub federation, storage quotas, security policy, and more.

Forgejo is now copyleft

The impact of the license change has been carefully considered with regard to the variety of usages of Forgejo. Someone might have chosen to avoid copyleft software, for example because it is discouraged in a company. However, Forgejo depends on Git, one of the most successful copyleft software. Both Forgejo and Git must be used together, either as individual binaries or bundled into the official container images. The license of Git is GNU GPL v2, another version of the same copyleft license.

The discussions on how to improve Forgejo's licensing are still very lively and will eventually lead to decisions that will improve its legal protection, in the interest of the general public.

Federation

Federation is getting useful. There is now more than preliminary background work, and the first exciting things could be tried out by users. The work is not near the goal yet.

Building upon the foundations released with Forgejo v8.0, a pull request for federated user activity following saw significant progress. The core idea is that any activity (where activity is defined as anything that ends up in the Forgejo user activity) is wrapped in an ap.Note, and sent to followers in the ActivityPub sense. Similarly, the inbox of local users now accepts such Notes. Additionally, there's now a "Feeds" tab on the user profile page, which displays the received notes.

go-git support is removed from the codebase

Forgejo used to have 2 Git backends: the normal git and go-git which is a Git implementation in pure Go. This had 2 benefits:

You don't need git installed.
It is a little bit faster than Git on Windows.

Noteworthy pull requests

Space usage quotas for users and organizations.
A release asset can be a URL instead of a file.
Add a cron task to cleanup dangling container images with version sha256:*.
Remove support for Couchbase as a session provider; it instead will now fallback to the file provider. The rationale for removing Couchbase support is that it's not free software, and therefore cannot be tested in Forgejo and neither should be supported.
Allow push mirrors to use a SSH key as the authentication method for the mirroring action instead of using user:password authentication. The SSH keypair is created by Forgejo and the destination repository must be configured with the public key to allow for push over SSH.
Forgejo Actions logs are compressed by default. It can be disabled by setting [actions].LOG_COMPRESSION=none.

OCI mirror

Forgejo maintains a mirror of container images that are commonly used in the CI and the release process. The primary motivation is to not be subject to rate limiting when using the Docker hub as well as saving bandwidth.

There still were two problems that led to a rate limiting incident disrupting the CI during a few hours:

A number of references to container images were not using the mirror - they were replaced
The mirror itself was rate limited because it used skopeo copy - it was replaced with skopeo sync

Release notes automation

In addition to the preview shown in each pull request, the Forgejo milestones for all upcoming releases are updated daily with the draft release notes compiled from all the pull requests.

Design and User Interface

Semantic HTML often was a discussion topic, and a pull request was merged to demonstrate how forms could look like with less classes and less weird divs all over the place. They bring consistency out of the box (you only need to change some CSS properties, no need to keep your templates in sync). It was followed by a refactor of some forms to improve semantic HTML, usability, accessibility, and reduce the JavaScript footprint.

A discussion started to improve the testing infrastructure. The "reasonable effort" for the tests is eaten up by just figuring out how to get test data populated. Contributors asked to write tests, should not follow a paper chase. It led to pull requests to move CreateDeclarativeRepo to more accessible location and improve diffs generated by Forgejo to make testing more convenient.

Helm chart

The Forgejo helm chart had many minor and patch updates, in both v7 and v8. Helm chart v7.0.5 and v8.1.1 were released which contain Forgejo security fixes.

Each version is tested against a kubernetes cluster to verify it works. It was using kind but it turned out to be difficult to debug when the number of transient errors increased. K3S is used instead and proved to be more stable.

Forgejo v8.0 install party

The Forgejo v8.0 install party was a nice community meetup and we got to know some Forgejo users. Some users performed their updates live and had only minor issues that were mostly caused by an issue on their end. Due to the lack of actual problems, some might have perceived it as boring. Finally, it was decided to also upgrade Codeberg to Forgejo v8, which was also a smooth experience.

Social account

https://floss.social/@forgejo was setup about two years ago and it works flawlessly. However, a problem emerged over the past six months that requires finding a new home: the moderation team at floss.social cannot be contacted, despite numerous attempts over a period of months and via multiple channels.

Nothing indicates it is anything more than a case of being overwhelmed by requests on a rather large instance. But it is best addressed by looking for a new home now instead of waiting that an event requiring moderation happens and is left unattended.

Security policy

A discussion began in 2023, before Forgejo became a hard-fork of Gitea, to improve the security collaboration with upstream projects. It led to a security policy that was agreed on according to the Forgejo decision making process.

Dependency management

A dedicated renovate repository runs every 30 minutes in the https://code.forgejo.org instance to service Forgejo related projects, saving them the burden of running it individually.

The configuration of renovate within Forgejo spaces is the same with regard to Go dependencies. Instead of repeating them in each repository (forgejo/renovate.json, runner/renovate.json), they import a shared configuration found in a repository created for that purpose.

Localization

5 batches of translation updates were merged with 2090 new strings and 1020 string improvements - more than the previous two months combined.

The localization team keeps making sure that the merged translation updates are backported to the current stable versions of Forgejo, so that the releases are always shipped with the most complete and highest quality translations available.

Forgejo is used by a wide variety of people and organizations around the world. For some of them the availability and quality of translations are important factors. Everyone is welcome to contribute to the localization by translating and checking strings. Details on how to participate can be found here.

Forgejo runner

A new version of the Forgejo runner was published which fixes a security issue. It was made easier by using the same tooling as Forgejo itself to upgrade the dependencies.

Security is the most important aspect that the Forgejo runner needs to address before it can be considered for beta testing and will be helped by a security audit which is in the early stages with Radically Open Security.

It will also need more contributors to help with its long term maintenance and anyone interested is encouraged to join.

Sustainability

Donations to the Forgejo Liberapay team reached around 40€ per week and are distributed to three beneficiaries.

Drawing upon previous sustainability discussions, a grant application was submitted for the Sovereign Tech Fund.

The creation of a sustainability team, tasked to map out and implement a strategy on how to make Forgejo a durable endeavour over the next years was proposed.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo is now copyleft, just like Git

Thu, 22 Aug 2024 00:00:00 GMT

Forgejo is changing its license to a Copyleft license. This blog post will try to bring clarity about the impact to you, explain the motivation behind this change and answer some questions you might have.

How will this impact me?

We have carefully considered the impact the license change has on the variety of usages of Forgejo, and we believe there is little reason to worry. We are not aware of any negative consequences implied by the license change to users who are aligned with Forgejo's values. While we cannot give legal advice of any kind, we'll give a first overview of the new requirements.

If you set up Forgejo from our official distributions (e.g. binaries, docker images etc), it is very unlikely that you are affected at all. We do our best to ensure that our Forgejo distributions are fully compliant out of the box.

You can also build Forgejo from source, even modify it, host it for yourself and others.

If you are redistributing Forgejo binaries, for example because you are packaging it for GNU/Linux distributions or some specific container / package format, you are now required to provide the full source of your Forgejo variant (including potential modifications) under the same license terms as Forgejo itself.

You are free to sell Forgejo services, including hosting it for others. If you act according to our values and ensure your users receive the freedoms Forgejo grants you, it is unlikely that you have to do adjustments to your business now or in the future.

You might have chosen to avoid copyleft software, for example because it is discouraged in your company. However, Forgejo depends on Git, one of the most successful copyleft software. Both Forgejo and Git must be used together, either as individual binaries or bundled into the official container images. The license of Git is GNU GPL v2, another version of the same copyleft license.

Why the license change?

A copyleft license makes reusing other copyleft software easier. Recently, we discovered that some of the dependencies we used were incompatible with the license Forgejo was distributed with, and they had to be removed for now. Choosing copyleft licenses enables us to reuse more work, and saves us precious time to focus on improving Forgejo itself.

Copyleft licenses do not only benefit the developers. They also guarantee freedoms to users of the software. They reduce the risk of exploitive business practices, like creating a modified version of Forgejo with less freedoms to the users, which could ultimately trap users in a vendor lock-in.

What is changing, now and in the future?

Forgejo versions starting from v9.0 are now released under the GPL v3+ and earlier Forgejo versions, including v8.0 and v7.0 patch releases remain under the MIT license.

The license of Forgejo is not carved in stone and this change shows that it can adapt to the needs of the project. It also shows that it is a long process: it took months of discussions to reach the agreement in 2023. And another year for it to be put to use. This slow pace reflects how difficult it is to make a sound decision knowing it will have a long lasting impact.

The discussions on how to improve Forgejo's licensing are still very lively and will eventually lead to decisions that will improve its legal protection, in the interest of the general public.

Contribute to Forgejo

Forgejo is in a unique position among the software forges: It serves its users and is guaranteed to be free and independent, managed by a non-profit organization and a transparent governance process.

If you are considering contributing to Forgejo, now that your work is protected by a copyleft license, we welcome you to our exciting journey and we are looking forward to forging with you.

If you want to back Forgejo's independence with a financial contribution, check out our newly-created Liberapay team to compensate our developers for their invested time.

If you have any feedback or suggestions, do not hold back, it is also your project. Open an issue in the issue tracker for feature requests or bug reports, reach out on the Fediverse, or drop into the Matrix space (main chat room) and say hi!

Forgejo Security Release v8.0.1 & v7.0.7

Fri, 09 Aug 2024 00:00:00 GMT

Forgejo v8.0.1 & v7.0.7 was released 9 August 2024.

These releases contain a fix for a security issue, which can be exploited by registered Forgejo users who can change the description of a repository. A change introduced in Forgejo v1.21 allows a Forgejo user with write permission on a repository description to inject a client-side script into the web page viewed by the visitor. This XSS vulnerability allows for href in anchor elements to be set to a javascript: URI in the repository description, which will execute the specified script upon clicking (and not upon loading). AllowStandardURLs is now called for the repository description policy, which ensures that URIs in anchor elements are mailto:, http:// or https:// thereby disallowing the javascript: URI.

Recommended Action

We strongly recommend that all Forgejo installations are upgraded to the latest version as soon as possible.

Contribute to Forgejo

Forgejo monthly report - July 2024

Wed, 31 Jul 2024 00:00:00 GMT

A non-free JavaScript library was found in the project's dependency structure, and the entire component that relied on it was re-implemented. The new versions 8.0.0 and 7.0.6 were released without this library. This step is important to meet the core values of Forgejo.

Forgejo v8.0 is available with new features (support for workflow dispatch, better defaults to avoid spam on new instances etc.), a new approach to UI and UX, careful upgrade of dependencies to improve stability and security. Foundation parts for ActivityPub based federation and data portability were merged in.

Forgejo v8.0 release

A gentle way of describing Forgejo User eXperience is that it is an acquired taste: it grew over the years, driven by the inspiration of the person with the keyboard in their hand. Once implemented it almost never changed. A user who started with Forgejo in 2022 can only see minor changes in 2024 and not all of them make intuitive sense. The solution to this problem is simple and was identified early on: User Research. But only in the making of Forgejo v8.0 did it get some momentum.

A special effort was also made to reduce the breaking changes of this release to a minimum. For instance it would have been easier to implement this improvement to the rootless OCI image as a breaking change. But significant time was spent to figure out a way to make it backward compatible. Another example is the new default for self-registration that only applies to new installations to not require a manual intervention to change the settings.

Licensing

The release of Forgejo v8.0 was delayed because it was discovered that a non-free dependency of a dependency initially created for Gitea was loaded into the project.

The dependency already existed at the time of the fork from Gitea and was therefore included in Forgejo from the beginning. The commitment of Forgejo is to always be free as in freedom, open source and a community-first product. Non-free dependencies and distribution licenses are incompatible with the values of Forgejo. Therefore, it was of high importance to remove the problematic dependency

In June last year an agreement was reached by which:

Forgejo accepts contributions compatible with the GPLv3-or-later license. The license under which Forgejo is distributed will be changed upon the acceptance of such contributions. See the LICENSE file for the current license.

This has not happened yet but there now are pull requests in flight that have copylefted code in them. Discussions started to find the best way to move forward.

Design

The forgejo/design repository was created. Design being wider than the visual appearance, it's about User eXperience, workflows, efficiency, and even technical aspects. It is the interface between the UI and User Research Teams, they iterate on features, gather data, exchange ideas.

The envisioned workflow is:

Feature requests are filed to Forgejo.
When some of them sound interesting or related, a new issue in forgejo/design is created to coordinate the work on a feature.
New insights (e.g. from user research, but also from duplicate or related issues) can be quickly referenced in the related issue.
The related Git repository is used for developing the actual state of the feature. People can propose changes which are documented in markdown files.
Whenever a design is ready, it can be referenced again in the Forgejo repository and used for implementation.
When a developer wants to start working on something and would like to get design feedback, they also open an issue in the design repo to gain input UI wise and from user research.
Finally, the design repo should contain guidelines for consistency as a developer resource.

Helm chart

It is used to deploy the test instances *.next.forgejo.org using a dedicated repository in the newly created infrastructure organization that contains the code automating the updates to the Forgejo infrastructure.

The Forgejo helm chart had four patch updates, one for 7.0.2 which depends on Forgejo v7.0.5, one for 7.0.3 and another for 5.1.3.

A new major version, 8.1.0 was published and includes Forgejo v8.0.0 as well as changes from the Gitea chart.

Localization

Malayalam and Serbian translations, although incomplete, existed in the past but were deleted from the repository over a year ago, before the Forgejo localization team was established. They were stored on a proprietary translation platform, waiting to reach a percentage of completion before being added back. But Forgejo works differently: all translations are present in the repository and only a selected subset is displayed to the user, when they reach an acceptable completion percentage. The once deleted files for Malayalam and Serbian were restored in the repository to help resume the translation effort.

Release notes assistant

Forgejo release notes do not fit the popular trend that consists on enforcing conventional commits so that tools can collect them because:

The unit of change in Forgejo is the pull request, not the commit. It is not uncommon for a pull request to contain multiple commits that are related but independent from each other. Squashing them into a single commit is not an option. There are diverging opinions on the matter and enforcing a merge policy where pull requests are always squashed into a single commit leads to a nicely flat commit history. But Forgejo made a different choice.
A single commit or pull request may require multiple release note lines. When upgrading a dependency by modifying one line in the go.mod file leads to user facing changes, each of them needs to be described in the release notes. Forgejo relies on hundreds of other Free Software projects and although most of them are plumbing that the Forgejo user do not need to be aware of, others are very visible such as the web editor.
Release notes need manual editing. No matter how good and disciplined the author of a pull request is, there will be typos and unification problems that are best addressed when preparing the release, at the very last stage.

Discussions started early 2024 (here and there) to distribute the release notes workload to the author of each pull request rather than relying on a single person manually doing the same a few days before the release. As the number of contributors to Forgejo increased significantly early 2024, the quality of the v7.0.0 release notes was sub-standard and a solution had to be found.

Read more in the Scaling out Forgejo release notes postmortem.

Sustainability

Donations are now accepted for the Forgejo Liberapay team. Liberapay is a French non-profit dedicated to crowdfunding with predictable income, allowing transfers via multiple payment options and providers with a comparably low fee. It was already possible to donate to Codeberg e.V., and part of the funding was used to compensate for work on Forgejo. However, the Liberapay team now allows for money to go directly to developers without a roundtrip to Codeberg. Additionally, Liberapay allows for a steady and reliable funding stream next to other options, a crucial aspect for our project. The distribution of funds through Liberapay is transparently controlled using our decision-making process, and Forgejo contributors are encouraged to consider applying to benefit from this funding opportunity.

The NLnet grant application submitted 1 April passed the first round of review and will have to answer questions to qualify for the second round.

Drawing upon previous sustainability discussions, a grant application was drafted for the Sovereign Tech Fund. It seems to be a good fit for Forgejo, and in particular for the a similar project outline already proposed to OTF. Unlike the OTF call, STF does not have deadlines for general funding requests. It could be submitted before mid-August.

Discussions started to establish a sustainability team, tasked to map out and implement a strategy on how to make Forgejo a durable endeavour over the next years. It seems that the project is at a point where it could use a concerted effort in this direction, even if, or maybe because, it isn't a very popular matter.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Non-free dependency discovered in Forgejo and removed

Tue, 30 Jul 2024 00:00:00 GMT

On 18 July 2024, a small piece of non Free Software was discovered within the Forgejo codebase. It is only used to display the top authors contribution graph (which is part of the repository activity) in the web interface. A replacement was implemented and merged on 20 July 2024. This piece of non-Free Software is no longer contained in the v8.0.0 release and the v7.0.6 point release.

During a discussion about the future of Forgejo's license, it was discovered that a non-free dependency of a dependency initially created for Gitea was loaded into the project.

The usage of the non-free dependency was reported in the main issue tracker on 18 July. A few hours later, a pull request was opened to remove the dependency. In addition, a discussion was created to track the problem and the resulting consequences as a whole. The pull request was merged just over one day after the initial submission.

The release of 8.0.0 was therefore blocked until the problem was solved. The removal of the binary was also ported to 7.0.6.

Additionally the author of the dependency and Gitea were informed of the non-free subdependency.

In order to rule out further infringements, an improved tool was introduced to check the licenses of all dependencies. It runs in the CI, and fails if an incompatibility is found. Due to the new tool which works more precisely, it can lead to more licenses being included in the license.txt - also from dependencies that are removed in the build process. But better this safe way than missing licenses from dependencies in the end.

Because GSAP, the indirect dependency, is not Free Software, it cannot be distributed in the Forgejo organization hosted by Codeberg. It is prohibited by the Codeberg Terms of Use and goes against the Forgejo core values. The Forgejo binaries and container images will be deleted. It will take some time, since the technical impact on existing Forgejo instances that depend on them has to be carefully addressed.

During the investigation, two other indirect dependencies with incompatible licenses were found.

One is a dependency which was used for citing a repository in APA format (if the repository is set up for this) and has been removed for the moment. It has a more restrictive, copyleft license which is incompatible with the current license of Forgejo. Repositories can therefore currently only be cited in the widely used BibTeX format. As Forgejo decided to accept copyleft license last year, this dependency may be added again in the future.

The other is elkjs included by Mermaid. It also has a more restrictive, copyleft license which is incompatible with the current license of Forgejo. Since elk as renderer is experimental so far, it was decided to remove elk manually. If you decide to set elkjs specifically as a renderer, an error now occurs. This is currently the only solution for the license issue.

Forgejo v8.0 is available

Tue, 30 Jul 2024 00:00:00 GMT

Forgejo v8.0 was released 30 July 2024. You will find a short selection of the changes it introduces below and in a complete list in the release notes. It is released the same day as Forgejo v7.0.6 to address licensing issues impacting frontend features (APA citation format, mermaid ELK rendering and the display of contributor graphs). Read more in the dedicated blog post.

It comes with a number of new features, as usual. But the most impactful changes are of a different nature: increased stability, less random UI modifications and almost no breaking changes.

A newly created UI team engaged in a different approach and can be credited for a drastic reduction in random User Interface changes in this release.
A dependency dashboard is now used to carefully watch over each of them, with a direct impact on stability and security.
The breaking changes were reduced to a minimum because there is now an increased focus on backward compatibility.

If stability is more important than new features, consider using Forgejo v7.0 instead: it is a Long Term Support release that will receive bug fixes until 16 July 2025. Forgejo v8.0 will be supported until 16 October 2024, when Forgejo v9.0 is published.

A dedicated test instance is available (v8.next.forgejo.org) to try it out. Before upgrading it is strongly recommended to make a full backup as explained in the upgrade guide and carefully read all breaking changes from the release notes. If in doubt, do not hesitate to ask for help on the Fediverse, or in the chat room.

New features

Manually trigger a Forgejo Action workflow with the input provided by the user in the web interface.
Self-registration is now disabled by default on the installation page. This is done to prevent the creation of unmaintained instances with open registration that are abused by spammers for malicious purposes.
Generated release attachments can optionally be hidden to not be confused with the archives uploaded by the user. For instance, each Forgejo release includes a source archive which is different from the generated archive.

A new approach to UI and UX

The first user visible benefit of the new approach is a drastic reduction of the seemingly random User Interface changes that were frequently found in previous releases.

The time and energy of Forgejo contributors with the skills and desire to improve the User eXperience went in four equally important directions:

Conducting user testing sessions (June 2024 and April 2024) to observe how Forgejo is used. How do users work with Forgejo? What problems do they run into?
Discussing a new workflow for designing and implementing feature requests. The focus is on the problems rather than the solution. When a user or a developer has a solution in mind, it is not uncommon that it does not solve an actual problem.
Giving some love to the current user interface, fixing bugs and backporting them to the stable versions (e.g. 7.0.5). Review and apply upgrades of JavaScript packages and other dependencies used to build the UI.
Improving the JavaScript test coverage which is still currently under 10% but has seen more improvement in the past three months than in the past two years.

In a nutshell, Forgejo's goal is now to design its User eXperience based on what user needs, as demonstrated by observations, rather than what they think that they want.

Removal of Microsoft SQL Server support

When Forgejo started almost two years ago, it focused on supporting and documenting a subset of the features present in the codebase. It made a implicit promise to its users to produce quality releases where new features could be added and bug fixed. It is a simple problem to solve as long as there are two necessary ingredients:

Contributors with the knowledge to diagnose a problem
Automated tests guarding the code against regressions when a new feature or a bug fix is merged in the codebase

Microsoft SQL Server never met these conditions and discussions began early 2024 to address the problem. The short version is that there is no reported use of a Forgejo instance running Microsoft SQL Server currently, and the decision was made to remove it from the codebase.

An alternative would have been to leave it, to give a chance to someone with the right skills to step up and contribute their knowledge to support Microsoft SQL Server. But that would not solve the other problem: because Microsoft SQL Server is not Free Software, it cannot be integrated in the automated tests. That would be adding a non Free Software dependency to Forgejo, which goes against its core values.

Because Forgejo is still young and none of its users rely on Microsoft SQL Server support, it can be dropped without inconveniencing anyone. As Forgejo's popularity grows, keeping the feature in the codebase would increase the probability that users rely on Microsoft SQL Server. It would then be a difficult situation for Forgejo and it is best to avoid that trap.

See also the related section on standard formats and protocols in the June 2024 report.

Less breaking changes

A special effort was made to reduce the breaking changes of this release to a minimum. For instance it would have been easier to implement this improvement to the rootless OCI image as a breaking change. But significant time was spent to figure out a way to make it backward compatible. Another example is the new default for self-registration that only applies to new installations to not require a manual intervention to change the settings.

Improved stability

Forgejo directly depends on hundreds of software projects: OCI images are based on Alpine Linux, markdown rendering uses goldmark, TLS certificates are obtained using certmagic and the list goes on, ranging from CI tooling that only matter to Forgejo developers to user interface components such as the editor used to write issue comments.

Watching over those dependencies was an unsolved problem:

bugs (or even security) fixes were not applied because no contributor had the time or the inclination to watch over them manually
batch upgrades, dozens of direct dependencies at a time, occasionally happened without actually reading through the release notes of each of them, let alone evaluate the risk of regression or the new features they include

It was resolved in v8.0 with specific tooling and a dependency dashboard updated hourly by renovate and watched over daily by Forgejo contributors. When a new release of a dependency is published, it is immediately proposed for review and the decision to upgrade is made in accordance to the new dependency management process. The tooling made it possible and sustainable to observe the evolution of hundred of dependencies.

The immediate benefits are:

more stability as batch upgrades no longer happen with the associated risk of regression
bugs and security fixes found in dependencies are applied without undue delay, and backported to stable releases

Gitea compatibility

Forgejo v8.0 was manually tested to be compatible with Gitea v1.22. Users reported successful upgrades of an instance of Gitea v1.22 to the development version of Forgejo v8.0. In addition, automated upgrade tests from Gitea v1.22 to Forgejo v8.0 were implemented and are run prior to each Forgejo release.

An instance running Gitea versions up to v1.21 can be upgraded to Forgejo v7.0 or v8.0
An instance running Gitea v1.22 can be upgraded to Forgejo v8.0

Release schedule and Long Term Support

Date	Version	Release date	End Of Life
2023 Q4	1.21.1-0	26 November 2023	17 July 2024
2024 Q1	7.0.0	23 April 2024	16 July 2025
2024 Q2	8.0.0	30 July 2024	16 October 2024
2024 Q3	9.0.0	16 October 2024	15 January 2025

8.0-test daily releases

Releases are built daily from the latest changes found in the v8.0/forgejo development branch. They are deployed to the v8.next.forgejo.org instance for manual verification in case a bug fix is of particular interest ahead of the next patch release. It can also be installed locally with:

OCI images: root and rootless
Binaries

Their name stays the same but they are replaced by a new build every day.

Localization

The localization team brought a batch of translations weekly, from the Weblate project. A particular effort was made to backport all of them to Forgejo v7.0.

The work on refactoring base localization to improve User eXperience and translatability was also ported to v7.0, when there was no risk of regressions.

Anyone is welcome to participate in improving translation for their language as well as the English base.

Federation

Does Forgejo support federation? Not yet. Was there progress? Yes.

Building blocks for both ActivityPub federation and data portability improvements were merged into the codebase. They are not yet used for any user visible feature but they are a stepping stone. Their implementation was made significantly easier by the hard fork because they can rely on a codebase that is better tested.

The ActivityPub based communication between two Forgejo instances is used by a new internal test scenario where adding a star to a repository on one instance also adds a star on a federated repository on the other instance.

Read more about federation and data portability in the June 2024 Forgejo monthly report.

Get Forgejo v8.0

See the download page for instructions on how to install Forgejo, and read the release notes for more information.

Upgrading

Carefully read the breaking changes section of the release notes.

The actual upgrade process is as simple as replacing the binary or container image with the corresponding Forgejo binary or container image. If you're using the container images, you can use the 8.0 tag to stay up to date with the latest 8.0.Y patch release automatically.

Make sure to check the Forgejo upgrade documentation for recommendations on how to properly backup your instance before the upgrade.

Contribute to Forgejo

Donate

Forgejo is proud to be funded transparently. Since a few days, we additionally accept donations from our users through our Forgejo Liberapay team. If you appreciate Forgejo, consider setting up a donation to help going forward. Liberapay is a French non-profit dedicated to crowdfunding with predictable income, allowing transfers via multiple payment options and providers with a comparably low fee. It was already possible to donate to Codeberg e.V. (you can still do in case the Liberapay option does not work out for you), and part of the funding was used to compensate for work on Forgejo. However, the Liberapay team now allows for money to go directly to developers without a round-trip to Codeberg.

Additionally, Liberapay allows for a steady and reliable funding stream next to other options, a crucial aspect for our project. The distribution of funds through Liberapay is transparently controlled using our decision-making process, and Forgejo contributors are encouraged to consider applying to benefit from this funding opportunity. Thank you for using Forgejo and considering a donation, in case your financial situation allows you to.

Forgejo Upgrade Party and Get-Together

Let's upgrade together!

The Forgejo v8 release is available. We are looking forward to meeting with you via OpenTalk, providing a space for admins and developers to assist each other. We are excited to learn from your setups and the challenges you encounter to further improve Forgejo in the future.

Read the full invite on the Codeberg Event Calendar!

Forgejo monthly report - June 2024

Sun, 30 Jun 2024 00:00:00 GMT

The User Research effort that gained momentum two months ago continues with a new round of user testing sessions. It is key to collect evidence about what Forgejo users need, a requirement to build a roadmap and reduce the growing backlog of bug reports and feature requests.

User Research

Discussions began on a new workflow for design work and feature requests. Users are encouraged to describe the problem rather than the solution. Feature requests typically consist of the description of a solution. However, often there are multiple solutions to one problem, and there are multiple problems with one solution.

New feature requests are not ready to implement: they are investigated first, similar to how new bugs are triaged. A research and design process can be established, similar to what was done for the summary tab for repositories and bootstrap actual process for changes in Forgejo. This adds a step between what user needs and development, but since the backlog of feature requests is growing anyway, it may not be an issue. On the contrary: merging similar feature requests together can reduce the backlog of open feature requests and only the most valuable changes are implemented.

A new round of user testing sessions was conducted from 26 June to 28 June. It is based on an interview script improved from the one that was already used in April 2024 during the first round.

Features

Notable improvements:

Read more in the pull requests.

Standard formats and protocols

Forgejo supports third party software and services that use standards. For instance it relies on SQL for interactions with databases, HTTP, HTML and JavaScript for web interactions. As an exception when the software or service is available under a Free Software license, the absence of standardized communication protocol is not a requirement, for instance for LevelDB.

It is not an easy goal to achieve because software publishers keep deviating from standards or change the license of their software to no longer be Free Software.

Microsoft SQL Server deviates from the SQL standard in ways that required special treatment and the decision was made two months ago to no longer include such specific adjustments.
Redis used to be Free Software, but the newer versions are not. The protocol is not standard but alternative servers exist and Forgejo is now tested to work with them. Only the older Free Software version of Redis will continue to be supported, but the proprietary versions will not.
Safari is expected to support HTML, HTTP & JavaScript in the same way other browsers do, but fails some tests. The approach chosen was to skip Safari testing instead of finding a workaround. An effort is generally made to workaround the non-conformant behavior of Free Software Web browsers. But, for reasons similar to MSSQL, such an effort is not sustainable for proprietary Web browsers.

Other discussions happened on integrating Forgejo with third party software or services that are not Free Software and do not comply with a standard format or protocol (Azure Blob Storage, CockroachDB and Friendly Captcha).

Data portability

The Friendly Forge Format (F3) is designed to improve data portability and make it possible to mirror software projects from one forge to another using a standard format. The v2.0.0 was published in June 2024 and is the first stable version. It is implemented in a Go package that can be used as a reference. A native driver for Forgejo was merged so that it can be used, for instance, to transport data when an ActivityPub message is received. Or as an alternate implementation for the migration code.

Read more in F3 related issues and pull requests.

Federation

The pull request to implement federated repository stars was merged. The feature allows you to define following repositories such as origin of mirrors or forks. If then the mirror or fork gets a star by someone, the origin repository will also get a star via federated ActivityPub like activity. Only the star activity is federated, the unstar activity is not federated and the user interface is not available yet.

A new federation suite was added to the end-to-end tests. It is very basic but the first of its kind. Launching two Forgejo instances that star each other via ActivityPub.

Although GitLab federation efforts are now on pause it includes an experimental implementation of the ActivityPub building blocks which is roughly at the same stage as Forgejo. Support for launching a GitLab instance was added to the end-to-end tests. This will eventually allow to play scenarios in which GitLab and Forgejo can communicate in a controlled environment. And in the short term to apply minimal testing on each of them independently, for instance with activitypub-testing.

UI team

The UI team was created and has three members.

Before engaging in more ambitious goals, they started to care for the day to day chores that keep Forgejo releases going:

Implementing and reviewing new UI features which is particularly challenging because the test coverage of the Web UI is still very low.
Backporting bug fixes to the stable versions (7.0.4 & 7.0.5).
Reviewing upgrades of JavaScript packages and other dependencies that are used to build the Web UI. It would be relatively easy if every package consistently complied with semantic versioning and published descriptive release notes. But the norm is rather the opposite and each potential upgrade requires a fair amount of scrutiny.

An experiment to hire a freelance to work on improving the JavaScript test coverage was conducted to figure out if it leads to results that are worth the effort. It was interrupted when evidence surfaced that the work was almost identical to what an AI would produce.

Infrastructure

The machine added last month is now in production and stable. It did not go smoothly because the hardware provisioned turned out to be unreliable and crashed frequently. The devops team spent hours over a period of a week to figure out the root cause and stabilize it. This was not transparent to Forgejo contributors because the CI stopped working half a dozen time and stayed down during a few hours. But nothing was lost and the downtime was kept to a minimum. It happened in between releases and did not disrupt the release process.

The upside of these troubles was to check that every aspect of the disaster recovery scenario work as it should, including loosing all disks on the machine. The defective hardware was not stabilized, it could not. It turned out that all machines with the same motherboard were similarly flawed. Hetzner acknowledged their defective product range, apologized, reimbursed the costs and is in the process of changing their Q&A to include the test script that was provided to demonstrate the problem.

Releases

Forgejo v7.0.4 (fixing vulnerabilities) was released. The security fix it contains was also backported and released as Forgejo v1.21.11-2.

There now is a stronger requirement for testing for all backports to a stable release. The bug fixes originating from Gitea were previously merged even when they were not covered by any test. Tests are now added when the fix is worth the effort. The test itself is implemented in the development branch and the commit that contains the fix is cherry-picked with the backport of the test to demonstrate it works as it should.

A discussion regarding the Forgejo v8.0.0 feature freeze an attempt to better define the requirements imposed during such a period and the need to fix bugs when the infrastructure to write tests is missing.

Dependency Management

Caring for the hundreds of Forgejo dependencies has been a recurring activity since the beginning of the project back in 2022. When the hard fork happened early 2024 Forgejo gained the freedom to decide on each of them and began to organize accordingly. Gitea was first and using the dedicated tool that was developed to sort the commits of interest became a comfortable weekly routine.

The backlog of all other dependencies was more challenging. A dependency dashboard was setup and started with a large backlog. Only in June 2024 was it cleared, months later. Pull requests with upgrades are now dealt with daily and diligently so they do not pile up again.

The method to analyze each of them was documented and heavily relies on the dependency specifications to keep the workload to a minimum. For instance it can arrange for updates to only be proposed every three months for CI tooling while it immediately proposes an upgrade if has an impact on security.

Helm chart

The Forgejo helm chart had two patch updates, one for 7.0.1 which depends on Forgejo v7.0.4 and another for 5.1.2 which depends on Forgejo v1.21.11-2.

The Forgejo helm team was created was created and two members joined.

Localization

4 batches of updates were merged containing total of 937 new translations and 518 improvements. Some improvements were made to the process of localization management. One of which is that now backporting of translation updates to stable versions can happen in batches before releases are published instead of weekly.

No new team applications were submitted or accepted this month. Some languages are not actively maintained currently. View completeness of translations in our project on Codeberg Translate and Learn how to help.

Sustainability

There is a new funding opportunity for Sovereign Tech Fund and a grant application is being drafted. Its scope is similar to OTF and most of the material can be re-used.

The grant proposal submitted 16 May for the Free and Open Source Software Sustainability Fund was declined. In a newsletter OTF announced that they received 80 applications.

A reply was expected for the NLnet grant application submitted 1 April but was further delayed and is expected in July.

Moderation

There has been very few minor moderation incident (spam or trolls) and one time warning. This is significantly less than the past month where there were bursts of unsolicited activity that sometime required daily intervention. Even the smallest interventions were logged in accordance to the moderation process.

A concern was raised regarding the lack of answer of the floss.social moderation team despite numerous attempts over a period of months. There has been no major incident so far but it may be wise to take steps for Forgejo to be in a space where it is possible to reach the moderation team before it happens.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo monthly report - May 2024

Mon, 03 Jun 2024 00:00:00 GMT

A UI team was created by Forgejo contributors who have been at work for months on the necessary backports of bug fixes to the Forgejo v7.0 stable branch. More ambitious discussions started on the long term strategies to refactor the codebase and improve the User eXperience.

Call for help

Forgejo needs help to triage bug reports and feature requests. The growing backlog is not a new problem and is actively worked on. If you ever create a new issue, take a moment of your time to also look at a few others and help them get to the finish line.

For a bug fix, reading the description and trying to reproduce it manually to confirm it is still relevant will bring them closer to a resolution. Either because the developer knows it is worth their time or because it cannot be reproduced and is already fixed.
For a feature request, read the Needs and benefits section and maybe ask the author to clarify. If you are convinced, add a short comment in the first person to describe how it would help you.

UI team

The Forgejo UI discussions led to the creation of a UI team and four candidates (1, 2, 3, 4) are lined up to be the initial members to bootstrap it.

A dedicated Matrix channel was created and added to the Forgejo Matrix space.

In addition to discussions regarding future developments, the team took care of the UI related features and bug fixes, both for the development branch and for the stable branch.

Code

Features

Notable improvements and bug fixes:

Groundwork for stars federated via ActivityPub (1, 2, 3, 4)
Allow hiding auto generated release archives
Code Search for non-default branches and tags when repository indexer is disabled
Parse prefix from redis URI for queues
Wiki content search using git-grep

Read more in the pull requests.

Improving tests

A discussion started to improve the tests in the Forgejo codebase. Initial ideas cover the following:

Allow integration tests outside of the tests/integration folder
Prevent having to store binary blobs within the codebase
Make the tests faster
Document the testing tweaks
Add test coverage
Add performance testing
Make the playwright tests easier to use

End to end tests

The end to end test suite race conditions (in the tests of push and scheduled actions) were fixed. It still suffers from transient environmental failures (it relies or a large number of external resources), but it happens less than once a week. In some cases it can be fixed by adding a retry.

A test for the pull request automerge features was added.

Deprecating go-git

Discussions to deprecate go-git received strong support. If Forgejo wants to support go-git, every git Feature also needs to be implemented in go-git. For example: setting git notes in the Web UI is currently not possible in go-git.

The benefits of go-git may not be worth the effort. Git is already preinstalled on many distributions. If Forgejo is installed using Docker or a package manager, Git will already be installed with it.

Infrastructure

A new machine was added to the Forgejo infrastructure. The capacity provisioned last year proved to be enough to sustain the increased activity since early 2024, with no slowdown or space restrictions. Even if the number of Forgejo contributors do not increase this year, testing federated features will require significantly more resources, for instance to launch a GitLab instance with ActivityPub extensions enabled.

The forgefriends hosting request is partially complete. The https://code.forgejo.org/forgefriends/ and https://code.forgejo.org/f3/ organizations were created and allocated Forgejo Actions runners. The F3 organization was migrated from the GitLab instance. The F3 forum was migrated to a dedicated LXC container.

A semi-manual static page hosting service dedicated to code.forgejo.org was created. It is deployed to host the F3 and forgefriends websites and could be used as an alternative to Uberspace for https://forgejo.org.

Releases

Forgejo v7.0.2 and Forgejo v7.0.3 (fixing vulnerabilities) were released.

They both rely on the release note files that are created at the same time as the pull requests.

After a commit made its way to the v7.0 branch and was reverted at the last minute to avoid regression, it was proposed to require testing for all non-trivial commits cherry-picked from Gitea into the stable branch.

Dependency Management

Tooling

The cherry-picking tool developed to keep track of commits cherry-picked from related repositories is used for:

OCI mirror

Forgejo maintains a set of OCI images mirrors for the benefit of the CI, so that it is not rate limited by docker.io. They were previously manually maintained and a weekly scheduled workflow was created to take care of it automatically.

It was initially held back because of a long standing bug preventing the use of docker buildx imagetools create to mirror multi-architecture OCI images. It was worked around using skopeo which provides the same feature but does not run into the Forgejo bug that would prevent it to work.

Helm chart

The Forgejo helm chart had one major update.

The Forgejo helm chart moved from forgejo-contrib to a dedicated organization.

A Forgejo helm team was proposed, with two potential members. A dedicated Matrix channel was created and added to the Forgejo Matrix space.

Localization

3 new team members were onboarded: [1], [2]. 5 batches of updates were merged containing total of 515 new translations and 1122 improvements. Traditional Chinese have seen a particularly high amount of fixes and improvements this month from a new team member. All translation changes got backported to according point releases of Forgejo v7.0, which is expected to continue receiving translation improvements.

There are still countless improvements to be made for many languages and you can help to improve the localization too. Learn how.

Federation

The pull request to implement federated repository stars was split into smaller ones, five of which were merged in the development branch.

Federated staring of repositories (in review)
UI to define following repos (merged)
Finalize receive activity (merged)
Creation of federated user (merged)
Federation: Parse ActorId & cache FederationHost (merged)
Validate like activities (merged)

Read more in the May 2024 reports (1, 2).

Governance

Sustainability

The discussion started on Forgejo durability in the next 10 years led to a grant proposal submitted 16 May for the Free and Open Source Software Sustainability Fund.

A reply was expected for the NLnet grant application submitted 1 April but was delayed because of the large number of applicants. The arrangements made to ensure the two grants do not overlap in time were changed. Because of this delay and on condition that an extension can be negotiated, avoidance of an overlap may no longer be necessary.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo monthly report - April 2024

Tue, 30 Apr 2024 00:00:00 GMT

Contributors got together to celebrate the release of Forgejo v7.0 and Codeberg was upgraded the next day. A lot of effort went into the automation of the development process, for dependency management and releases, so that contributors can focus on what matters most. As Forgejo matures, more and more of the work is about day to day management of bug reports, localization, security, etc. All aspects that make Forgejo a product that can be relied on for the years ahead. 17 interviews were conducted to better understand how Forgejo is used and shape its roadmap in a user centered way.

Forgejo 7.0

Forgejo v7.0 was published 23 April with translations in Bulgarian, Esperanto, Filipino and Slovenian; SourceHut builds integration; support for the SHA-256 hash function in Git; source code search by default and more. It also is the first Long Term Support version and will receive updates until July 2025. The adoption of semantic versioning is the reason for the version bump from v1.21 to v7.0 and is compatible with existing tools.

Regressions and 7.0.1

Previous Forgejo releases were synchronized with the Gitea release cycle and usually published after the first patch release, when the most disruptive bugs or regressions were discovered and fixed.Forgejo became a hard fork two months ago and it was its first major release. Two significant regressions were discovered less than 48h after the release. Their impact and workarounds were documented by amending the 7.0.0 release notes while the 7.0.1 patch release was prepared. It was released four days later.

Celebration and motivations

On 27 April Forgejo contributors got together in a videoconference to celebrate the publication of the 7.0 release and remember the evolution of the project since its inception in 2022. They also shared their motivations and goals for 2024 in a discussion for everyone to know what they find important, but also what motivates them to contribute to a given topic.

Codeberg upgrade

The Codeberg staging instance was used with Forgejo 7.0 release candidates and a copy of the production data in an attempt to identify scaling issues and regressions.

The Codeberg specific patches were ported (new templates and CSS need to be adapted) and Codeberg was migrated to 7.0 on 28 April.

Release notes quality

In order to improve the quality of the release notes, a new requirement to merging a pull request was discussed and led to an agreement proposal. The author of a pull request would be required to provide a snippet if their change needs to show in the release notes.

Backport automation

The git-backporting action was improved to support:

multiple targets
notifications on error
merged and squash pull requests

As expected it is now used to backport most pull requests from the development branch to the v7.0/forgejo branch.

The release notes themselves that were previously only found in the development branch are now also backported to the stable branch where they belong.

Code

https://codeberg.org/forgejo/forgejo

Notable improvements and bug fixes:

Read more in the pull requests.

Security

There is no direct impact of the xz backdoor (CVE-2024-3094) on Forgejo. This CVE got a lot of attention and a blog post was published to explain why Forgejo is not affected.

The Forgejo v1.21.11-0 release was published 18 April and contains two security fixes: a privilege escalation that allows any registered user to change the visibility of any public repository; and a cross-site scripting (XSS) vulnerability that enabled attackers to run unsandboxed client-side scripts on pages served from the forge's domain.

User Research

The work started early March on Forgejo Usability and Designing a modern contribution workflow led to 17 interviews for which transcripts were archived. They provide material that can be re-used in various contexts, even for the benefit of forges other than Forgejo.

Some of the information already influenced decisions and implementation details in discussions, and issues were created in response to the user interviews, for example to improve the new repo units button and feedback for features that are still in development, such as improving assignment to issues.

A discussion on how to move on with user research was started.

A survey started on Exploring the Contributor Experience where Forgejo contributors are asked to answer a series of questions.

Dependency Management

The dependency update dashboard is used daily to observe and update Forgejo dependencies. When a new release is available, a daily scheduled workflow will create a pull request which:

will be merged automatically, for instance if it is a patch upgrade from a dependency known to have a trusted release process
be reviewed by a Forgejo contributor to decided if it worth an upgrade

With hundreds of dependencies, there is a significant backlog to absorb and it is done incrementally by improving the configuration file with:

groups of dependencies, for instance postcss where multiple dependencies are treated as one
automerging patch releases
adding custom dependency detection

When Forgejo became a hard fork two months ago, maintainers switched from rebasing weekly on top of Gitea to cherry picking commits instead. A tool has been developed to make this process easier, and automate as much of it as possible. As the tool keeps evolving, the weekly cherry pick pull request become easier to create, review, and even includes interesting statistics at the bottom of the summary.

Forgejo v1.20 end of life

With the release of Forgejo 7.0, the Forgejo v1.20 release is EOL (End Of Life) and will no longer receive security patches. The last of them was backported and made available in the v1.20/forgejo branch for the benefit of source builds in April.

The end-to-end tests were also updated to remove v1.20 support and the policy to managed legacy tests was documented.

Debian packages

The Debian package has undergone extensive changes. In addition to gaining support for Forgejo v7.0 LTS, its CI was migrated to Forgejo Actions and includes a pull request test suite. The repository now has an LTS release channel. Enhancements are in the works to remove Forgejo's common data from the compiled binaries and instead storing it in a forgejo-common package. This lays the groundwork for things like multi-architecture builds.

A call for maintainers was posted so that there are at least three maintainers to ensure:

Debian packages are available within 12 hours of Forgejo releases
Pull requests can be reviewed by at least one maintainer

References:

https://codeberg.org/forgejo-contrib/forgejo-deb

Helm chart

The Forgejo helm chart had one major updates.

References:

https://codeberg.org/forgejo-contrib/forgejo-helm/releases

Localization

The localization keeps going forward. 1 member was onboarded and 2 more applications were created. Some optimizations to the merge process were made to make it go faster. 6 batches of updates were merged, containing total of 2273 new translations and 1913 improvements. The translation effort had finally seen the light with the Forgejo 7.0.0 release, which is the first release containing major Forgejo localization improvements. There are still countless improvements to be made for many languages and you can help to improve the localization too. Learn how.

Federation

The pull request to implement federated stars passes tests and is ready for merging. It is a very large pull request and it was requested by reviewers to split it into smaller, more manageable pull requests. In the same way the large webhook refactor was done. The first pull request was open and is its final stage to validate ActivityPub messages.

A new pull request to implement federated search was proposed with a demonstration searching for an actor on https://next.forgejo.org from a locally running Forgejo instance.

Governance

Sustainability

The discussion started on Forgejo durability in the next 10 years led to drafting a grant proposal for the new Free and Open Source Software Sustainability Fund. It proposes the creation of a non-profit organization managed transparently so that it can be audited at any time. Its purpose would be to define a collective roadmap and use the grant to fund the work. To preserve the Forgejo dynamic that is key to its momentum, it will be setup to ensure volunteers keep being its driving force.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo v7.0 is available

Tue, 23 Apr 2024 00:00:00 GMT

Forgejo v7.0 was released 23 April 2024. You will find the most interesting changes it introduces below and in a complete list in the release notes.

The adoption of Semantic Versioning 2.0.0 is the reason for the version bump from v1.21 to v7.0 and is compatible with existing tools.

Translations in four new languages with a usable level of completion are available to users: Bulgarian, Esperanto, Filipino and Slovenian.
SourceHut Builds integration can be used to submit jobs to SourceHut on push events.
Source code search code now available by default using git grep.
Activity graphs show the contributors, code frequency and the recent commits in the activity tab of repositories.
The wiki can be edited by any user with read permissions by selecting Allow anyone to edit the wiki on the repository settings. The default is to only allow users with write permissions on the repository.
Git repositories using SHA-256 are supported. Although Git repositories using SHA-1 are not vulnerable to collision attacks since Git v2.13.0, this hash algorithm is still weak. Git transition to a SHA-256 hash function was decided to be trustworthy and useful in practice for at least 10 years. As of Forgejo 7.0.2 some features are still unreliable when using SHA-256.
Repository badges can be used to embed information about a given repository such as the CI state, the number of issues, etc.

7.0 Long Term Support (LTS) and semantic versioning

The 7.0 version is the first Long Term Support (LTS) release. Critical bug and security fixes will be published in patch releases (7.0.1, 7.0.2, etc.) until July 2025. It is also the first version to use semantic versioning. Forgejo implemented semantic versioning internally in earlier releases (for instance v1.21 is v6.0) and it is now exposed publicly.

Gitea API compatibility

Tools that are developed for the Gitea API will keep working with the new Forgejo numbering scheme. They typically make assertions on the release number to unlock new functionalities and that logic will not be impacted by a bump in the release number. The proprietary version of Gitea has a different numbering scheme (v21.X.Y, v22.X.Y) and is in a similar situation.

Time based release schedule

The time based release schedule was established to publish a release every three months. Patch releases will be published more frequently, depending on the severity of the bug or security fixes they contain. The exact number of the release cannot be known in advance because it will be determined by the features and breaking changes it contains, as specified by the Semantic Versioning 2.0.0 specifications.

Date	Version	Release date	End Of Life
2024 Q1	7.0.0+gitea-1.22.0	23 April 2024	16 July 2025
2024 Q2	8.0.0+gitea-A.B.C	17 July 2024	16 October 2024
2024 Q3	X.Y.Z+gitea-A.B.C	16 October 2024	15 January 2025
2024 Q4	X.Y.Z+gitea-A.B.C	15 January 2025	16 April 2025

7.0-test daily releases

Releases are built daily from the latest changes found in the v7.0/forgejo development branch. They are deployed to the https://v7.next.forgejo.org instance for manual verification in case a bug fix is of particular interest ahead of the next patch release. It can also be installed locally with:

OCI images: root and rootless
Binaries

Their name stays the same but they are replaced by a new build every day.

Webhook subsystem refactor

The webhook subsystem underwent a substantial refactor to ease the additions of new webhook types. The SourceHut Builds is a driving example of how the refactored webhook architecture can be used to implement a new webhook type.

Localization

Forgejo now got its own independent localization foundation. New teams were formed, a Weblate project was set up. The localization no longer relies on a proprietary service.

Work on refactoring base localization to improve User eXperience and translatability is in progress. Lots of strings were updated to improve readability and be easier to understand, many got basic plural support. File and repo sizes were made translatable, localization of activity heatmap was fixed.

As soon as the initiative was announced in January, the call for participation got a great response and volunteers from around the world are working daily to improve translations. New languages were added. The ones which got active maintainers and have reached a usable level of completion were made available to the users: Bulgarian, Esperanto, Filipino, Slovenian.

Anyone is welcome to participate in improving translation for their language as well as the English base.

Federation

Does Forgejo support federation? Not yet. Was there progress? Yes.

The monthly reports have details on these progress.

Forges have existed for over twenty years and none of them has achieved data portability let alone federation. Forgejo is one year old and it will take it a some time to get there.

Get Forgejo v7.0

See the download page for instructions on how to install Forgejo, and read the release notes for more information.

Upgrading

Carefully read the breaking changes section of the release notes.

The actual upgrade process is as simple as replacing the binary or container image with the corresponding Forgejo binary or container image. If you're using the container images, you can use the 7.0 tag to stay up to date with the latest 7.0.Y patch release automatically.

Make sure to check the Forgejo upgrade documentation for recommendations on how to properly backup your instance before the upgrade.

Contribute to Forgejo

Forgejo Security Release 1.21.11-0

Thu, 18 Apr 2024 00:00:00 GMT

Forgejo v1.21.11-0 was released 18 April 2024.

This release contains two security fixes, both of which can be exploited by registered Forgejo users. One flaw allows anyone who can open a pull request against a repository to change its visibility. The other lets the attacker run unsandboxed client-side scripts on pages served from the forge's domain, a Cross-site scripting (XSS) vulnerability.

Recommended Action

We strongly recommend that all Forgejo installations are upgraded to the latest version as soon as possible.

Privilege escalation through `git push` options

By far the more serious issue is a privilege escalation through git push options, which allowed any registered user to change the visibility of any repository they could see - public repositories included -, regardless of what level of access they had.

A more detailed deep-dive about this vulnerability will follow in a later blog post.

Cross-site scripting (XSS) vulnerability

The other vulnerability is a Cross-site scripting (XSS) vulnerability that could be exploited by a registered Forgejo user.

In certain situations, rendered repository contents weren't properly guarded, and allowed unsandboxed client-side scripts to run from the same domain as the forge itself.

Contribute to Forgejo

Forgejo monthly report - March 2024

Sun, 31 Mar 2024 00:00:00 GMT

Forgejo 7.0.0 release candidates are now available for testing at https://v7.next.forgejo.org or by downloading OCI images (root / rootless) and binaries that are updated updated daily.

The 7.0.0+LTS-gitea-1.22.0 version is the first Long Term Support (LTS) release and will receive critical bug and security fixes until July 2025. It is an additional burden on Forgejo contributors and members of the release team. Individuals and organizations who need that kind of stability are kindly invited to contribute to this effort so it can be sustained in the long run.

New languages that got active translators and have reached a usable level of completion were added and are now visible to users: Bulgarian, Esperanto, Filipino and Slovenian.

New release management

Now that Forgejo forked its own way forward, it became necessary to define when and how releases are published.

Semantic versioning

The first Forgejo version to be published with its own release management will be 7.0.0+LTS-gitea-1.22.0 and the documentation was updated to explain the new numbering scheme.

Gitea API compatibility

Forgejo 7.0 release candidates

The 7.0/forgejo branch was cut 30 March 2024 and the v8.0.0-dev tag set to the development branch. While the release-critical bugs are being fixed so that the version can be published, https://v7.next.forgejo.org will keep being updated daily with a build of the latest commit, acting as a release candidate where anyone can safely try and break it. It can also be installed locally with:

OCI images: root and rootless
Binaries

Their name stays the same but they are replaced by a new build every day.

Forgejo 7.0 LTS

Now that Forgejo has given itself the mean to avoid most of the regressions that it suffered from in the past, it can provide support for releases during a longer period of time. The 7.0.0+LTS-gitea-1.22.0 version is the first Long Term Support (LTS) release and will receive critical bug and security fixes until July 2025.

Time based release schedule

Date	Version	Release date	End Of Life
2024 Q1	7.0.0+LTS-gitea-1.22.0	17 April 2024	16 July 2025
2024 Q2	X.Y.Z+gitea-A.B.C	17 July 2024	16 October 2024
2024 Q3	X.Y.Z+gitea-A.B.C	16 October 2024	15 January 2025
2024 Q4	X.Y.Z+gitea-A.B.C	15 January 2025	16 April 2025

Code

https://codeberg.org/forgejo/forgejo

Notable improvements and bug fixes:

Webhook refactor and addition of SourceHut builds is a series of 7 pull requests, 6 of which have been merged.
A number of localization improvements (1, 2, 3, 4, 5, 6, 7, etc.)
Tests now fail instead of just displaying error logs. This should help catch missing translations and ensure that an error is logged only when an inconsistency is detected within Forgejo (which shouldn’t happen if the test is realistically setup).
Recognize SSH signed tags in addition to OpenPGP.
Add S3 bucket lookup type and documentation.

Read more in the pull requests.

Backport automation

When pull requests are merged, a workflow will automatically open a backport. If the backport/v1.21 label is found, it will target the Forgejo v1.21 branch. If there are no conflicts and tests pass, it can be merged right away and save valuable time.

As Forgejo 7.0 enters the release candidate stage of its life cycle a significant number of backports are expected during the first few weeks and such an automation will have even more of an impact.

Dependency Management

A dependency update detection cron job has been setup to automatically open pull request proposing updates when new versions of Go or JavaScript packages, OCI images and more are available. It finds the release notes, adds them to the pull request description and Forgejo contributors can then conveniently decide whether an upgrade is necessary. This recurring observations of Forgejo dependencies is fine tuned by a configuration file that, among other things, ensures there are at most five pull requests proposed at all times.

The weekly cherry-pick of commits from Gitea became a routine collectively managed by two Forgejo contributors. It is one of the improvements brought by the hard fork decision from last month. Rebasing was more involved and managed by a single person: an undesirable single point of failure. A tool was created to automate the most tedious and error prone tasks.

End to end tests

The end-to-end tests were entirely refactored for unification and simplicity. They cover the following areas:

They can now all be run by adding the run-end-to-end-test label to a pull request (see this example). Before the refactor, only Forgejo Actions tests were run.

Localization

New languages that got active translators and have reached a usable level of completion were added and are now visible to users: Bulgarian, Esperanto, Filipino and Slovenian.

New contributors were onboarded (1, 2) to the localization team.

The English source strings saw a lot of activity for unification and rewording. There were no notable conflicts with Gitea translations. There was one conflict caused by merged pull request in Forgejo that locked translations for about half of a day. Although Weblate owns all translated files and they are not to be modified in pull requests, there are exceptions. When mass modification can be automated, this can be done by a pull request and to save valuable translators' time. But when it happens, care must be taken to avoid conflicts and the required steps were documented.

The upside of this incident was to show that resolving such conflicts is as simple as reverting the faulty commit and opening a new pull request. It is not the most efficient way to go about it, but it is simple.

Federation

The pull request to implement federated stars made progress. In the settings of a repository there is now a field allowing to define its federated repositories. Read more in the activity summary.

The federation implementation task list was updated.

Helm chart

The Forgejo helm chart had one major updates because of a major bump of the postgresql dependencies.

References:

https://codeberg.org/forgejo-contrib/forgejo-helm/releases

Runner

The Forgejo runner version 3.4.1 was published and supports for the artifacts@v4 protocol when used with the development version of Forgejo 7.0, as demonstrated by the end-to-end tests.

With the caveat that a forked version of the matching download and upload actions must be used because they both assume a GitHub environment. Chasing such features is high maintenance and casts a doubt on its long term viability. The Forgejo runner makes no promise of compatibility with GitHub and an alternative action with the same interface but implemented differently may be, for example, a more sustainable choice.

References

Governance

Sustainability

A discussion started in an attempt to find an answer and make Forgejo durable for the next 10 years.

A grant proposal was drafted to support the development of Forgejo.

An additional Request for Payment was sent to NLnet in the context of the ongoing grant and the funds will go to Codeberg.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Impact of CVE-2024-3094 on Forgejo

Sun, 31 Mar 2024 00:00:00 GMT

On 29 March 2024 the details were shared of a backdoor in the xz source code. This backdoor, according to the latest reports, is capable of executing arbitrary code on affected machines which can lead to a full compromise of that machine.

Impact on Forgejo

Forgejo itself is not impacted by this backdoor, because it doesn't load the liblzma library that contained the backdoor, Forgejo does import the xz library but this has no relation to the liblzma library. Forgejo allows to use Git over SSH feature in two different ways.

Builtin SSH server

The builtin SSH server is integrated into every Forgejo binary, it uses an SSH server library to provide an SSH server. It is written in Go and doesn't load the liblzma library, therefore it is not affected.

Please read on if you're using Forgejo in a containerized environment such as Docker.

OpenSSH server

If you run an OpenSSH server that you installed independently of Forgejo, you could be affected by the backdoor. It depends on your distribution and configuration: the vulnerable xz versions (5.6.0, 5.6.1) could be in the package store and may have been installed. If you discover that your machine had it installed at any time, you should refer to your distribution's support or security advisories for more accurate information and to better understand the impact of this CVE on your installation.

If you deployed Forgejo using our official container images that also bundle an OpenSSH server, rest assured that these images never contained a vulnerable version. There is no need for action, because the images were based on Alpine Linux 3.19, which is not affected as per https://security.alpinelinux.org/vuln/CVE-2024-3094.

Impact on infrastructure

The infrastructure that powers Forgejo consists of:

Forgejo's own hardware used to create and sign the releases.
Codeberg that hosts Forgejo's source code and the releases.

These machines all run Debian GNU/Linux Bookworm, a stable version of Debian. The security advisory of Debian for this CVE clarified that no Debian stable versions were impacted by this backdoor. Additionally, the public detection script was run on the Forgejo machines and confirmed that the vulnerable liblzma library is not present on the machine.

Forgejo monthly report - February 2024

Thu, 29 Feb 2024 00:00:00 GMT

The monthly report is meant to provide a high level view of what happened in Forgejo in the past month. If you would like to help, please get in touch in the chatroom or participate in the ongoing discussions.

Since its inception, Forgejo has been a soft fork of Gitea. Over time, it developed its own identity, adopted both development and governance practices - to ensure the stability, quality, and openness of the project - that made it more challenging to remain a soft fork. The decision was made to become a hard fork, and for Forgejo to forge its own path going forward. Read more in the blog post announcing the decision.

Forgejo reached 1,000 stars on Codeberg and it is heartwarming to see so much support. Each of these stars are more valuable than those loaned by proprietary forges: they really belong to Forgejo and come from developers who made an effort to register on Codeberg.

Implementation of the hard fork

The hard part was to make a decision, the implementation itself (as laid out in the decision) is comparatively simpler and is now in place.

Publish a blog post explaining the decision.
Switch from rebasing weekly (see this rebase example) to cherry-picking weekly (see this cherry-pick example).
Update the developer documentation to update the parts that are no longer needed.
Merge all feature branches and delete the branches that are no longer necessary.
Develop tools and procedures are in the design phase and discussions mostly happen whenever cherry-picking from Gitea.

Code

https://codeberg.org/forgejo/forgejo

Notable improvements and bug fixes:

Add colorblind theme variants.
Use git grep to search repositories when the repository indexer is not configured.
Improvement to the Agit workflow (PRs 1, 2, 3).
Fix error when marking outdated code reviews as resolved (PR 1, 2).
Allow instance-wide disabling of forking.
Improve display of 404/500 error pages.

Read more in the pull requests.

In flight pull requests

Most pull requests are opened and closed within a week. But some of them take a longer time, either because they are more complex or because they are taken care of by volunteers who can only occasionally work on them in their free time. This is a list of those that were updated since the last monthly report. If they are of interest to you, reviewing the changes or providing solutions would be appreciated.

Documentation

Updates cherry-picked from the Codeberg and Gitea documentation.
Newer user guide on the AGit workflow.
New section in the developer guide for testing strategies and requirements.

FOSDEM 2024

Codeberg's stand at FOSDEM was a success and it appears to have also been a success for Forgejo. There was a notable amount of people who were still looking for a self-hosted option and were curious to learn about Forgejo instead of GitLab or Gitea. The transparent stickers did not work out very well, because the colours do not cover enough, so the result was unreadable on dark background. Still, many people were interested in Forgejo stickers: several hundred of them were distributed. The NLnet stand had a different Forgejo sticker (hex variant) and probably used up their whole budget with distributing them. Read more in the FOSDEM 2024 discussion.

Discussions

A significant number of discussions revolved around the hard fork decision and most of them are linked from the governance tracker. A few long term discussions are also worth mentioning and participation would be welcome.

Monitoring forge features and its impact on forge federation

GitLab and GitHub releases are being analysed to figure out which features are added to each release. These projects are driven by gigantic corporations and the rhythm at which features are added is intimidating. The idea is not for Forjego to compete on the same ground: this is a race that is already lost. However gaining and maintaining a good understanding of their features is key to the success of the implementation of federation in Forgejo.

Gathering user feedback on accessibility

User feedback is the most valuable resource for projects. Lowering the barrier for its collection helps to get much more insights, because there are a lot of problems where users don't bother opening an issue. Read more.

(Scope of) Moderation of Forgejo instances

A discussion started a month ago about how to develop effective moderation mechanisms within Forgejo while maintaining means of dynamically reacting to changing problems. It aims at collecting feedback. How much is in the scope for Forgejo? What kinds of moderation actions do Forgejo admins need to perform? This kind of user research is instrumental to understand existing best practices in order to figure out what problems needs to be resolved first.

Federation

The pull request to implement federated stars made progress. Discussions happened on how a federated Person should be mapped to a local FederatedUser representation. Read more in the activity summary.

The F3 Forgejo driver refactor is complete: it is back where it was about six month ago. The representation of a remote user was split out of the driver as it is generally useful for both data portability and federation.

The federation implementation task list was updated.

Localization

The Forgejo translations have been liberated and now rely on a Free Software service. A localization team was bootstrapped and their work can already be seen in the experimental Forgejo instance. Translations for a few new languages began and will show when they are added to the Forgejo codebase. If you are fluent in another language and would like to help, please apply or join the localization chatroom to figure out what it entails.

References:

https://forgejo.org/docs/next/developer/localization/

Helm chart

The Forgejo helm chart had three major updates. Two because of major bumps of the postgresql dependencies and one because of merging upstream changes from Gitea chart.

References:

https://codeberg.org/forgejo-contrib/forgejo-helm/releases

Alpine Package Registry

The Alpine Package Registry now properly supports noarch package files, maintaining compatibility with the official Alpine Linux package repositories.

The logic for uploading a package to the Alpine Registry stored architecture independent packages (noarch) in their own architecture repository, instead of being available to all architectures available in the repository. Because of this, the Alpine Package Keeper wasn't able to locate the packages in the repository.

The architecture independent packages are now copied to all available architectures in the repository, and a fallback to x86_64 is used if the repository is brand new and doesn't contain any packages.

Releases

There has been one security release in February 2024. Forgejo admins are encouraged to subscribe to security announcement so they can better plan their upgrades.

Test release were once published manually on a weekly basis and used to upgrade https://next.forgejo.org upgraded. This process was automated and documented to happen daily. It runs the end to end test suite before being upgraded which helps detect regressions early.

References

Governance

Sustainability

https://prototypefund.de is open to proposal in 2024 and there were discussions about applications around Forgejo and federation.

Moderation

A moderation action was carried out to put an end to an ad-hominem attack. A few days later it turned out the person responsible was someone banned from Forgejo space in 2023. The ban was enforced and extended to help prevent future misbehavior.

References:

https://codeberg.org/forgejo/governance

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo Security Release 1.21.6-0

Thu, 22 Feb 2024 00:00:00 GMT

Forgejo v1.21.6-0 was released 22 February 2024.

This release contains a security fix related to Cross-site scripting (XSS) vulnerabilities that can be exploited by registered Forgejo users.

Recommended Action

We strongly recommend that all Forgejo installations are upgraded to the latest version as soon as possible.

Cross-site scripting (XSS) vulnerability

The Cross-site scripting (XSS) vulnerabilities can be exploited by a registered Forgejo user.

In some situations where a repository or user name contains HTML scripts, those values are not always properly escaped, thus leading to an XSS attack. For instance when:

It allows the attacker to inject a client-side script targeting visitors browsing a repository being migrated, the repository settings or the wiki. Note that the repository settings are only visible to repository admins.

Responsible disclosure to Gitea

On 22 January 2024, the Forgejo security team identified multiple Cross-site scripting (XSS) vulnerabilities could be exploited by registered Forgejo users, and the Gitea security team was notified. A 30-day embargo was requested, after which a patch to the v1.21 point release could be published.

On 14 February 2024, Gitea published a pull request that fixes the vulnerability, before the end of the requested embargo. It is embedded in a large refactor and not labeled to be security related but to a trained eye, this does catch attention.

On 17 February 2024, the Gitea security team privately sent a patch that fixes an additional XSS vulnerability.

Contribute to Forgejo

Forgejo forks its own path forward

Thu, 15 Feb 2024 00:00:00 GMT

Since its inception, Forgejo (a self-hosted git forge, like GitHub) has been a soft fork of Gitea. Upgrading to it was - and for the time being, remains to be - as simple as changing the URL from which the release is downloaded. Over time, the way Forgejo is governed and developed evolved. To be able to provide stable, secure, reliable releases, Forgejo requires a reasonable effort made at writing tests for each change that goes into the code. This has worked out remarkably well, as it caught both regressions in imported code, and mistakes in proposed changes. Furthermore, Forgejo has accepted features and other changes that are not available in Gitea, and has diverged in other ways already.

Today, Forgejo has a healthy number of people contributing to its main mission:

The community is in control, and ensures we develop to address community needs.

We will help liberate software development from the shackles of proprietary tools.

To continue living by that statement, a decision was made in early 2024 to become a hard fork. By doing so, Forgejo is no longer bound to Gitea, and can forge its own path going forward, allowing maintainers and contributors to reduce tech debt at a much higher pace, and implement changes - whether they're new features or bug fixes - that would otherwise have a high risk of conflicting with changes made in Gitea. Simply put, the governance and development models of Gitea and Forgejo diverged over time, and so did their goals. Becoming a hard fork is the culmination of that divergence.

The hard forking process

Forgejo has been, since its inception late 2022, a soft fork of Gitea which means it contains all of Gitea, both good and bad, with Forgejo having little control over what it is built on. However, some parts of Gitea were already "hard-forked" before:

Forgejo used Woodpecker first, then Forgejo Actions as its continuous integration system.
- In addition, the forgejo-runner is also a hard fork.
Documentation has been maintained independently for a good while now.
Stable releases are a hard fork since v1.20.
More recently, localization has been moved from Crowdin to Weblate.

Most of these steps were taken to liberate parts of the code base from proprietary solutions, to manage them with free software instead, and in the same process, make it simpler to manage Forgejo-specific changes. All while keeping the impact on the software itself minimal.

Consequences of becoming a hard fork

As of Forgejo v1.21, Forgejo contains all of Gitea, and that has the benefit of allowing Forgejo to be a drop-in replacement. With the decision to become a hard fork, this will no longer be guaranteed. It will remain possible to upgrade from the latest Gitea version released at the time of the hard fork, but versions past that will not have such a guarantee.

As such, if you were considering upgrading to Forgejo, we encourage you to do that sooner rather than later, because as the projects naturally diverge further, doing so will become ever harder. It will not happen overnight, it may not even happen soon, but eventually, Forgejo will stop being a drop-in replacement.

The Forgejo API will strive to remain compatible with the Gitea API going forward, after the hard fork. Existing APIs at the time of the fork are public, and changing them is a breaking change, which has to be evaluated very carefully, and not done lightly. Future APIs should similarly be evaluated, and Forgejo will try to remain compatible with Gitea. However, Forgejo contributors shall also use their own judgement whether to implement an API or not, and how - with the previous goals in mind.

Forgejo monthly report - January 2024

Sun, 28 Jan 2024 00:00:00 GMT

An agreement is discussed to make Forgejo a hard fork of Gitea.
User research is on the way regarding the (Scope of) moderation of Forgejo instances.
A new requirement to the development workflow was added to contain the technical debt.
The migration of Forgejo translations to the Codeberg instance of Weblate is on the way.

Forgejo

https://codeberg.org/forgejo/forgejo

Notable improvements and bug fixes:

Repository administrators can allow anyone to edit the wiki in the repository Settings. (#2001)
nuget api support serving package manifest
Fix false positive in database migration
Log SQL queries when the database return error
Instance administrators can enable repository badges in the configuration file. This feature depends on a shield generator service such as shields.io, and is disabled by default. (#2070)
Allow viewing the latest Action on the web: a tiny little convenience route that allows linking to the latest action of a repository. Useful for READMEs and CI badges.
Forgejo now recognizes more linguist attributes, making it possible to include documentation in the repository language statistics, for example. (#2088)
Users who signed up, but have not activated their accounts yet, are now able to change their email before activation. (#1891)
The "You pushed on branch ...." banner user experience was improved (#2141, #2195, #2196)

Read more in the pull requests.

In flight pull requests

Documentation

New section on how repo language detection works
New section on globally editable wikis
New setting [repository].DOWNLOAD_OR_CLONE_METHODS
new section on README badges feature
The Forgejo Actions reference guide was significantly improved. The Forgejo Actions tests were refactored to capture the event payloads. For instance when a workflow is triggered from pushing a commit, the event will contain information about the repository, the SHA etc. The captured events are automatically used to update the documentation. The event section of the Forgejo Actions documentation links to these examples and help figure out which fields are available depending on the type of event.

(Scope of) Moderation of Forgejo instances

A discussion started about how to develop effective moderation mechanisms within Forgejo while maintaining means of dynamically reacting to changing problems. It aims at collecting feedback. How much is in the scope for Forgejo? What kinds of moderation actions do Forgejo admins need to perform? This kind of user research is instrumental to understand existing best practices in order to figure out what problems needs to be resolved first.

Reducing the technical debt

A discussion on defining expectations regarding tests in the development workflow was concluded with a new requirement in the development workflow by which:

A reasonable effort has been made to test the change.

When developers do not perform tests (either automated or manual) end users experience bugs and regressions that are much more time consuming to diagnose and resolve.

Ideally Forgejo would have a hard commitment to only merge changes that are covered by automated tests. But there are many areas where the test infrastructure itself is still lacking (the web UI for instance) and manual tests are to be documented instead.

A draft implementation of a Rust based Forgejo SDK started using the Swagger file to generate code instead of manually implementing each API endpoint. Because the Forgejo Swagger file is currently manually maintained and only has a handful of recently added manual tests verifying it actually reflects the implementation, the author discovered inconsistencies that were fixed (see this PR for instance). When complete this SDK could be integrated in the Forgejo testsuite to verify the Swagger specification consistency and guard against regressions.

Federation

The pull request to implement federated stars made progress, replay attacks were analyzed and mitigated in k8s. Read more in the activity summary.

The F3 reference implementation was refactored and the old codebase archived. Read more in the January 2024 report. The F3 Forgejo driver refactor started.

The federation implementation task list was updated.

Localization

The Forgejo translations are depending on Gitea translations which are trapped in a proprietary service. A strategy was put in place to workaround the problem in 2022 and it worked fine until now, the overhead and problems were close to non-existent. Back then nobody knew Forgejo and establishing a brand new translation team would have been difficult but things are different now. There are significantly more people aware of what Forgejo is and willing to help.

Plans were made to bootstrap a translation team on Codeberg's Weblate instance and the implementation is well under way, with an initial localization team covering Arabic, Dutch, French, Russian, Hungarian, Greek and German. If you are fluent in another language and would like to help, please apply or join the localization chatroom to figure out what it entails.

Releases

There has been one minor security release in January 2024. Forgejo admins are encouraged to subscribe to security announcement so they can better plan their upgrades.

Codeberg suffered a DDoS attack that brought it down during more than 24h. Forgejo's own infrastructure was not impacted because it is hosted elsewhere and could have been used as an alternative to download releases. Only it did not have a mirror of the Forgejo releases. A daily scheduled action was created and the releases are now also available at https://code.forgejo.org/forgejo/forgejo/.

References

End-to-end tests

Forgejo end-to-end tests require running an actual Forgejo instance.

They were extended to include Alpine packages, verifying a package built out of an Alpine container image can actually be installed.

References:

Governance

Hard fork

A discussion started on the opportunity for Forgejo to become a hard fork of Gitea.

Over the past year a number of components have been developed in Forgejo independently of Gitea, they are already hard forks. The documentation, the release process, end-to-end tests, the Forgejo Runner etc. It even happened within the Forgejo codebase. For instance, the user blocking feature is independent from Gitea. It has its own database tables and migrations while being part of the same binary. However Forgejo still cherry-picks commits on top of the Gitea codebase on a weekly basis.

The discussion led to an agreement proposal where Forgejo community members expressed concerns that are addressed in accordance of the Forgejo decision making process. If an agreement is reached, the previous logic will be reversed and commits from Gitea will be cherry-picked on top of the Forgejo codebase.

The discussions related to this agreement are:

Testing strategies and containing regressions to support the main benefit of a hard fork which is to shield Forgejo from endemic regressions introduced in Gitea due to insufficient testing.
Integration of the Gitea changes inside Forgejo should the agreement pass.
Explicitly encourage contributions to Forgejo.
Gitea is Open Core explains why, with links for fact checking.
cloud.gitea.com shared account shows some of the proprietary features of Gitea Cloud and the non-Free Software version of Gitea that it runs.

Unless new concerns emerge, the agreement may be finalized in February.

Moderation

A moderation action was carried out to put an end to ad-hominem attacks and harassment: the person responsible for this behavior was banned for a period of two years. They have since created half a dozen accounts in an attempt to circumvent the ban but all content was removed or redacted within 24h.

References:

https://codeberg.org/forgejo/governance

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo monthly report - December 2023

Sat, 30 Dec 2023 00:00:00 GMT

Codeberg migrated to Forgejo v1.21 and suffered a downtime related to performance issues. Although it was quickly recovered, it shows work is still needed to improve scaling and stability.
A new forge comparison page is available. Gitea turned Open Core this month and it articulates why Forgejo is a safe heaven for admins who want to escape this trap.
The Forgejo Helm Chart reached general availability with version 1.0.0.
Forgejo end-to-end testing can now be triggered from Forgejo pull requests by setting a label. For instance, they were used to verify a bug fix in how scheduled actions work by automatically running an actual Forgejo instance and a runner.
Two new machines were added to the Forgejo infrastructure to service https://code.forgejo.org, an instance dedicated to Forgejo development.

As Forgejo grows, the format of this monthly report changed to distribute the workload among all Forgejo contributors. The summary is replaced with a bullet list of the highlights and the sections are written by the Forgejo contributors who have been active on a given subject. If you would like to help, please get in touch in the chatroom or participate in the ongoing discussions.

Forgejo

https://codeberg.org/forgejo/forgejo

Notable improvements or bug fixes:

Allow changing the email address before activation: In case someone accidentally registered with the wrong email address (made a typo, for example), with this PR, they will be able to change the email address, and request a new activation mail to be sent. This requires logging in, which is possible, even while the account isn't activated yet. Previously, this required help from an instance administrator, now it can be self-serviced.
Allow viewing the latest Action on the web: a tiny little convenience route that allows linking to the latest action of a repository. Useful for READMEs and CI badges.

In flight pull requests

Federation

The pull request to implement federated stars can now be tested manually and an activity summary was published.

The F3 refactor is making daily progress.

The federation implementation task list was updated.

Releases

Forgejo maintains two stable releases at any given time:

Stable (latest major version): receives full support, bugfixes and security fixes.
Old Stable (previous major version): receives only critical security support.

There has been one release a week in the past month, an unusually high frequency explained by a series of security vulnerabilities. They are labeled with a different color Stable and Oldstable to make it easier for the Forgejo admin to figure out which one applies to their instance.

The CVE-2023-49946 was created a week after the publication of the Forgejo v1.20.5-1 release that fixes this critical vulnerability. As a reminder the Forgejo v1.21 stable release already includes the associated security fixes and was never vulnerable.

Forgejo admins are encouraged to subscribe to security announcement so they can better plan their upgrades.

References

End-to-end testing

Forgejo end-to-end tests require running an actual instance and were moved to a dedicated repository which requires a significant number of manual steps to run them on a given Forgejo pull request. It was made simpler by triggering them with the run-end-to-end-tests label. For instance, in this Forgejo pull request setting the label triggered this workflow in the end-to-end repository, using a binary created with the pull request.

References:

Forgejo helm

Forgejo Helm Chart reached GA version 1.0.0 and is basically HA ready thanks to upstream Gitea Chart.

The only remaining issue is that all cron jobs are run on all instances because there's no leader elections yet.

References:

Codeberg

Codeberg migrated to Forgejo v1.21 and despite preliminary testing and a curated list of potential regressions, a performance issue prevented it from running. It was quickly diagnosed and fixed but the root problem remains: there is a lack of performance tests in Forgejo. That could be mitigated if there were other Forgejo (or Gitea) instances running at the same scale (~100,000 users and projects, publicly available) as they would also run into the same problems. But in the past years the vast majority of performance issues were discovered in the context of Codeberg, which strongly suggests it is the largest instance in existence.

A priority list has been established so Forgejo contributors can quickly figure out which problems deserve their attention.

References:

Forgejo runner

Forgejo runner 3.3.0 was published and is now IPv6 capable. Unfortunately there is a bug in Debian LXC support that limits the scope of tests it can support.

References:

Governance

Mergers team

The Contributors team has no permissions on "Code" which prevents members from merging pull requests although they have write permissions on "PullRequests" for the Forgejo repository. There is not much scrutiny to enter the contributors team because it bears almost no risk to the integrity of the Forgejo project. Being given permission to write the repository is a different matter. The new "Mergers" team is created and requires a formal application process. However light, it will make a difference that matters in terms of trust and commitment.

Moderation

Two moderation actions were carried out: one regarding an ad-hominem attack and another regarding the publication of private information.

References:

https://codeberg.org/forgejo/governance

Professional services

Forgejo, just like any other Free Software can be the base of commercial activity from service providers independent from the project itself. Forgejo exists under the umbrella of the Codeberg e.V. non profit which does not provide professional services so there is no competition and will never be.

Even if to address a handful of requests per year, it is convenient to have a place where people in need of professional services can meet service providers with the will and the skills to meet their needs. Here are some similar places in other Free Software projects:

It was decided to create a kind of job board which was bootstrapped as a dedicated issue tracker.

References:

https://codeberg.org/forgejo/professional-services

Hardware infrastructure

Two new machines were added to the Forgejo infrastructure and are now hosting code.forgejo.org that was previously in an OpenStack virtual machine. It is faster (10 times more bandwidth) and also is IPv6 capable. The LXC containers are setup and maintained using lxc-helpers.

A LXC container with extended capabilities required to run a nested k8s cluster was setup on an dedicated hardware for better isolation. Forgejo runners are installed for both lxc-helpers and forgejo-helm so they can run workflows that depend on k8s. For instance, it helped detect regressions with the Forgejo Helm chart prior to version 1.0.0.

The next.forgejo.org instance that is running the development branch of Forgejo (updated weekly) is now also hosted on this hardware. It was reset entirely on that occasion and displays a prominent reminder that there is no guarantee that any data will persist. It is only for experimental purposes.

References:

OCI mirrors

Container images hosted at https://hub.docker.com/ are subject to rate limiting which can be disrupting, for instance when the CI is used intensively by multiple contributors.

Some of the most commonly used container images used by Forgejo were manually mirrored in a dedicated organization to partially resolve that problem. Updating these images should be done automatically but there still is no script to do so.

References:

https://code.forgejo.org/oci/-/packages

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo Security Release 1.21.2-1

Tue, 12 Dec 2023 00:00:00 GMT

Forgejo v1.21.2-1 was released 12 December 2023.

This release contains a security fix related to permissions enforcement of web endpoints.

Recommended Action

We strongly recommend that all Forgejo installations are upgraded to the latest version as soon as possible.

The project page of private users is publicly visible

The project page of a private user was missing a permission check and was visible publicly. The other pages (packages, repositories, etc.) of this user or even its existence are not visible publicly.

Reminder of responsible disclosure

On 11 December 2023 the project page vulnerability was revealed publicly in contradiction with the Gitea and Forgejo security policies as well as the general principles of responsible disclosure.

This unfortunate incident forced the immediate preparation of this Forgejo patch release. With no advance warning it only allowed for limited testing and there is a non negligible risk of a regression.

In such a situation the Forgejo admins and users are suffering the consequences, either because they are left unnecessarily exposed to publicly known vulnerabilities or because their instance may run into regressions due to insufficient preparation time and testing.

If you discover a new vulnerability, you are urged to not reveal it publicly but to send an encrypted email to security@forgejo.org so this situation does not happen again.

Contribute to Forgejo

Forgejo monthly report - November 2023

Thu, 30 Nov 2023 00:00:00 GMT

Forgejo was created in October 2022 after a for profit company took over the Gitea project. In the beginning they were almost identical, except for the name and the color. But in the past year, this difference in governance led to choices that made Forgejo significantly and durably different from Gitea.

Better security. Forgejo focuses on identifying and fixing security vulnerabilities as soon as they are discovered. Gitea is always notified in advance via encrypted channels (e.g. Forgejo v1.20.5-1 or Forgejo v1.20.5-0).
More features. Forgejo includes all of Gitea features and integrates new one as soon as they are available. It is a 100% compatible drop-in replacement with additional features, self moderation being the first one.
Better stability. Forgejo relies on end-to-end and upgrade tests. The upgrade tests were introduced to address an instability caused by a regression in the storage settings.

Since its inception Forgejo has been strongly committed to provide forge federation. This long term work keeps contributors busy daily and it will still be a while before it is complete. Your help will make a difference and you are kindly invited to join the team. Your work will not help build a startup chasing unicorns, it will benefit the general public and yourself. You will only use Free Software as Forgejo is developed with Forgejo on Codeberg with a CI and releases powered by Forgejo Actions.

Development

v1.21 release

After eight release candidates over eight weeks, the Forgejo v1.21 release was published and the companion blog post provides a summary of the work it includes.

In flight pull requests

End to end tests

Forgejo contributors developed end to end tests which require running actual instances and realistic use cases. The proved particularly useful to fix and debug the regressions related to storage settings and verifying the workflows sent to the Forgejo runner succeed.

There were all moved into a dedicated repository where they can conveniently be run and developed rather than being scattered in the Forgejo repository itself or the setup-forgejo action.

Experimental releases

Starting 25 November 2023, test releases including the latest developments will be published on a regular basis, usually every week. They will be used to run https://next.forgejo.org. It is not recommended to use them in production.

Testing requirements

As a rule changes introduced in Forgejo are associated with tests that verify they work. Without such tests they are prone to regressions over time and more difficult to review. However, it is sometime challenging to create a new test when the underlying codebase lacks the basic infrastructure to do so. It is the case, for instance, for the JavaScript parts of the frontend or more generally user interface changes in Forgejo. As an exception, some pull requests will be merged without tests and tagged as such when they can be contributed back to the main author of the codebase and not burden Forgejo with the associated technical debt.

Federation

A new pull request was open to implement federated stars and an activity summary was published.

The F3 refactor is making daily progress.

The task list created a year ago to track federation work is now updated monthly.

Forgejo Actions

With the 3.2.0 release of the Forgejo runner, the LXC backend was improved and can now be configured with capabilities to run k8s. It unblocked the work started a few months ago to verify a helm chart using Forgejo can run in a workflow.

Groundwork for IPv6 support is done and needs testing before it can be released.

Security releases

Late October, the Forgejo security team discovered critical vulnerabilities and worked on fixes that were published as part of Forgejo v1.21 and backported to Forgejo v1.20.5-1 after a 30-day embargo. To better prepare for such upgrades, Forgejo admins can now watch a repository dedicated to security announcements or subscribe to the associated RSS feed.

The severity of the vulnerabilities motivated security team members to write a post-mortem and ask for input and ideas in an open discussion.

User research

Although it is largely agreed that user research is one of the areas where Forgejo needs more work, it has not seen significant progress in the past year. The effort has resumed, starting with sorting issues into categories. The goal is to better understand Forgejo users.

Hardware infrastructure

As https://code.forgejo.org keeps growing, new hardware is being provisioned so it can move from the cloud and have more disk space, mostly.

Governance and communication

The moderation team is now composed of two members. A Forgejo contributor also applied to the security team.

A few new members were added to the contributors team and it does not require a formal application process.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo Security Release 1.20.6-0

Tue, 28 Nov 2023 00:00:00 GMT

Forgejo v1.20.6-0 was released 28 November 2023.

This release contains a security fix related to permissions enforcement of API endpoints.

Recommended Action

We strongly recommend that all Forgejo installations are upgraded to the latest version as soon as possible.

API and web endpoint vulnerable to manually crafted identifiers

See the Forgejo v1.20.5-1 blog post for a detailed explanation on this kind of vulnerability.

get the public key of a user
get a release or a release attachment
get OAuth2 applications (except for the secret)

Fixes were written for the vulnerable endpoints but not thoroughly tested.

Reminder of responsible disclosure

Forgejo v1.20.5-1 was released 25 November 2023 after a 30-day embargo that gave enough time to Gogs, Gitea and Forgejo to prepare and publish a patch release on 25 November 2025.

The complete list of identified vulnerabilities was communicated by the Forgejo security team to Gitea on 5 November 2023 and the final version of the patch fixing all of them was sent on 24 November 2023, via encrypted email. In addition, two PRs (for v1.20 and v1.21) were sent to Gitea on 25 November 2023 prior to the announcement of the Forgejo release to help fast track a stable point release.

On 25 November 2023, shortly after the release, additional vulnerabilities were revealed publicly in contradiction with the Gitea and Forgejo security policies as well as the general principles of responsible disclosure.

If you discover a new vulnerability, you are urged to not reveal it publicly but to send an encrypted email to security@forgejo.org so this situation does not happen again.

Contribute to Forgejo

Forgejo v1.21 is available

Sun, 26 Nov 2023 00:00:00 GMT

Forgejo v1.21.1-0 is here and you will find the most interesting changes it introduces below. Before upgrading it is strongly recommended to make a full backup as explained in the upgrade guide and carefully read all breaking changes from the release notes. If in doubt, do not hesitate to ask for help on the Fediverse, or in the chat room.

Actions: server side, secrets can be managed via the API and the pull_request_target makes it possible to securely run workflows on pull requests, even when they need to access secrets. A major version of the Forgejo runner was also published and it is now capable of running actions on Docker, LXC or in a shell.
Blocking a user: repository transfers originating from the blocked user are canceled and the blocked user is removed from the list of collaborators on repositories owned by the user doing the blocking. This self-moderation feature introduced in v1.20 is most useful on large Forgejo instances and was since deployed on Codeberg. It has been used a few times by the Forgejo moderation team in cases that did not require admin privileges.
Documentation: new sections were added to the developer guide such as the user interface customization, which is considered an internal detail and requires intimate knowledge of the codebase to be maintained. Every new feature listed in the release notes was matched with an update in the documentation because it is intended to become an exhaustive reference. The documentation repository was split out of the website repository and restructured to facilitate the maintenance and contribution workflow.
Shortcut to create a PR: a button is automatically shown if you recently pushed to branch and will open a PR with the default branch as a base.
New user mail notification: When a Forgejo instance has open registration, it is occasionally subject to spam accounts. With the SEND_NOTIFICATION_EMAIL_ON_NEW_USER = true setting, the Forgejo admin will receive a mail when a new account is created and can immediately act on it, instead of discovering a dozen of spam bots a much later.
Additional syntax highlighting: for Smali, DHCP, WebGPU Shading Language, AutoHotkey, AutoIt, tal (uxntal), ArangoDB Query Language (AQL), BIND DNS Zone, Odin, Sourcepawn, CPP, C.
Additional language detection: Bluespec BH, D2, Go Workspace, Gradle Kotlin DSL, Hosts File, LOLCODE, MDX, Nasal, Nushell, Pact, RBS, Rez, Sweave, TL-Verilog, Typst, WDL, WGSL, WebAssembly Interface Type

Forgejo Actions

Forgejo is only as stable and robust as the test infrastructure that verifies it works. Forgejo Actions is not just a feature, it is an integral part of what makes Forgejo whole. With v1.21 this self-sustainable ecosystem grew with more components such as end to end testing and upgrade tests running older versions of Forgejo. Each repository is independent but it is not isolated from the others. Developers do not need to manually keep them in sync, they are bound together with tests. As more components are added, these tests will be the cement keeping them together, allowing developers to focus on what matters.

Server side the most notable improvements are:

The pull_request_target event is implemented and can securely access secrets because it runs using the workflows from the base branch instead of the pull request.
The API can now be used to manage secrets for users, organizations and repositories.
Registration tokens can register multiple runners instead of a single one.
Variables can be used in addition to secrets to configure workflows when there is no need for secrecy.
Recurring actions similar to cron jobs can be defined in the main branch.
Uploaded artifacts can be automatically cleaned up.
When a new commit is pushed to a branch, the workflows triggered by previous commits are automatically canceled.
It is now possible to upload multiple artifacts instead of a single one.
The labels can be communicated to Forgejo from the runner when they connect instead of just during registration.

Forgejo Actions is however not yet production ready, for the reasons explained in the Forgejo v1.20 blog post.

Client side, the newer version of the Forgejo runner that is responsible for running the workflows now comes in two flavors:

It is tested with itself to verify a new version does not introduce a trivial regression that would break Forgejo, using an action to cascade pull requests between repositories.

Read more about Forgejo actions in the user guide and in the administrator guide.

What is unique to Forgejo?

Until recently all Forgejo commits could have been merged into Gitea overnight. But as of October 2023 Gitea requires a copyright assignment in addition to the MIT license. It means that the most significant contributions such as blocking a user will not be merged into Gitea and are unique to Forgejo v1.21 and later.

Forgejo continues to include all of Gitea and guarantees a 100% drop-in replacement for Gitea admins. No action is required, it is enough to replace the Gitea binary or the container image with the equivalent Forgejo release and restart.

Such an upgrade may be motivated to benefit from security fixes that only exist in Forgejo, such as the Long-term authentication vulnerability which is fixed since Forgejo v1.20.5-0 and will also be in Gitea v1.22 early 2024.

Federation

Does Forgejo support federation? Not yet. Was there progress? Yes.

The monthly reports have details on these progress and the State of the Forge Federation: 2023 edition published in June 2023 explains how Forgejo fits in the big picture.

Forges have existed for over twenty years and none of them has achieved data portability let alone federation. Forgejo is yet to celebrate the publication of its first release and it will take it a little time to get there.

Get Forgejo v1.21

See the download page for instructions on how to install Forgejo, and read the release notes for more information.

Upgrading

Carefully read the breaking changes section of the release notes.

The actual upgrade process is as simple as replacing the binary or container image with the corresponding Forgejo binary or container image. If you're using the container images, you can use the 1.21 tag to stay up to date with the latest 1.21.x point release automatically.

Make sure to check the Forgejo upgrade documentation for recommendations on how to properly backup your instance before the upgrade. It also covers upgrading from Gitea, as far back as version 1.2.0. Forgejo includes all of Gitea v1.21.

Contribute to Forgejo

Forgejo Security Release 1.20.5-1

Sat, 25 Nov 2023 00:00:00 GMT

Forgejo v1.20.5-1 was released 25 November 2023.

This release contains critical security fixes related to permissions enforcement of API endpoints.

This release also contains bug fixes, as detailed in the release notes.

Recommended Action

We strongly recommend that all Forgejo installations are upgraded to the latest version as soon as possible.

API and web endpoint vulnerable to manually crafted identifiers

Some API endpoints, such as adding a reaction to a comment, rely on an identifier unique to an object (a comment in this example). There are similar cases for web endpoints which are used by the Forgejo web interface.

The permissions required for the user performing the action on the repository are properly enforced. But a check was missing to ensure that the object (a comment in the example) also belongs to the repository the permissions are checked against. Without this check it is possible both to perform destructive actions and to access information in repositories unrelated to the request, including private ones.

API and web endpoints have been analysed, and those that were missing such a verification can be exploited by a malicious actor to:

delete releases and tags
delete and modify issues or pull requests comments
reveal the content of issues or pull requests comments from private repositories
perform other non-destructive actions such as creating issues, moving pinned issues, or obtaining deploy public keys

The vulnerable endpoints were fixed and tests written to verify the fix is effective.

docker login and 2FA

When using docker login to authenticate against a Forgejo instance using basic authentication, there needs to be an additional verification if 2FA is activated for the user. That verification was missing for the API endpoint used by docker login, thus bypassing 2FA.

Responsible disclosure to Gitea

On 25 October 2023 the Forgejo security team identified that multiple API and web endpoints were not protected against manually crafted identifiers, and the Gitea security team was notified. A 30-day embargo was requested, after which a patch to the v1.20 point release could be published. Further research from both Gitea and Forgejo teams in the following days revealed more vulnerabilities. Initial fixes and tests verifying they are effective were exchanged, but after their last email on 31 October 2023 the Gitea security team stopped responding. Given the severity of the vulnerability, the Forgejo security team asked again for feedback on 16 November 2023, but did not get any reply. Having exhausted all options for cooperation, the Forgejo security team completed the security fix on its own. The resulting fix which is published in this release was sent to the Gitea security team encrypted in its final version on 24 November 2023. At the time of publication, there was still no response from the Gitea security team.

Responsible disclosure to Gogs

The Gogs developer was notified of the vulnerability on 25 October 2023. There is no encrypted channel and only a terse but unambiguous message was sent. There has been no response.

Forgejo will give advance warning of security releases

Similar to what is done when a Go release contains a security fix, Forgejo will now publish advance warning of security releases. They will not reveal the details of the vulnerability but will allow Forgejo admins to plan ahead and better secure their instance. Anyone can watch to the dedicated tracker or subscribe to the RSS feed.

Gogs and Gitea upgrades to Forgejo

Gitea admins are reminded that Forgejo is a 100% compatible drop-in replacement for Gitea. It is enough to replace the Gitea binary or the container image with Forgejo and restart. No configuration modification is necessary. They are encouraged to choose that option to get this security fix as soon as possible.

In the absence of a security fix for Gogs, it is also possible to try and upgrade Gogs to Forgejo. Note however that such an upgrade will require manual intervention and configuration changes because the upgrade path has not been tested.

Contribute to Forgejo

Forgejo monthly report - October 2023

Mon, 23 Oct 2023 00:00:00 GMT

A security issue identified earlier this year was fixed for Forgejo v1.21 and backported to Forgejo v1.20. It was non trivial and involved a 90-day embargo as well as a database upgrade. Four release candidates for Forgejo v1.21 were published in the experimental organization. The improvements it contains for Forgejo Actions were documented and are now associated with end to end testing to guard against future regressions.

A service request originating from German schools in need of additional Forgejo features was published. There are currently no known freelance or company providing Forgejo expertise and discussions happened about what to do with such requests. Solutions were also identified for bootstrapping a fully Free Software hosting provider including Forgejo.

Development

Refactor of Long-term Authentication

When a user logs into Forgejo, they can click the Remember This Device checkbox and their browser will store a Long-term authentication token provided by the server, in a cookie that will allow them to stay logged in for a number of days as defined by the LOGIN_REMEMBER_DAYS setting.

Given a copy of the Forgejo database, a Long-term authentication token could be constructed for any user and used to impersonate them. Such a token did not expire LOGIN_REMEMBER_DAYS days after it was created and remained valid for as long as users did not change their password.

This security issue does not require brute force and was the most significant discovered this year. A fix was published by the Forgejo security team on 6 October 2023 after a 90-day embargo and was backported to Forgejo v1.20.5-0 the same day.

v1.21 release candidates

The Forgejo v1.21 release candidate cycle is coming to an end, with four releases, published in the experimental organization. They are now used daily on the https://code.forgejo.org and https://next.forgejo.org instances and all the release blockers discovered so far were fixed.

Tests were conducted on a simulation of a Codeberg upgrade to verify the database migration was fast enough, despite some operations that were potentially expensive on large tables.

End-to-end testing for Forgejo v1.20 is part of the setup-forgejo action testsuite. It was extended to include the Forgejo v1.21 release candidates and new tests for the Forgejo Actions features that did not exist in Forgejo v1.20.

Federation

ForgeFlux is working towards providing compliance testing for the forge federation ecosystem using a tool called "ftest". The tool ran successfully against Forgejo and produced this compliance report proving the correctness of Forgejo's work-in-progress implementation.

The F3 Forgejo driver is on pause while the gof3 package is undergoing a complete refactor. The API will be roughly the same and allow to copy data from one forge to another.

Forgejo service providers

Forgejo exists under the umbrella of Codeberg which is a non-profit organization. But it can be used by freelancers or for-profit companies to generate an income. Just like there are many service providers using Git which exists under the umbrella of Software Freedom Conservancy.

Professional services

When someone needs a Forgejo instance of their own but does not have the resources to maintain and improve upon it, they should be able to find help, for a fee. For instance the German state of Baden-Württemberg needs additional features to deploy Forgejo in German schools next year. The new development could then be contributed back to Forgejo and be available for all.

Hosting provider

If someone is looking for a hosting provider where they can rent their own Forgejo instance and Forgejo runner without being bothered by upgrades, they currently have nowhere to go.

The easiest solution would be that Forgejo is part of the application portfolio of an existing hosting providers. But none of them is powered by Free Software and the Forgejo instance would be trapped: migrating to another hosting provider would require a significant effort.

There are two fully Free Software stacks providing a turnkey solution to setup a hosting service provider. One of them is unmaintained and the other needs a Forgejo driver.

Documentation

The bulk of the documentation updates relate to the new Forgejo v1.21 features of Forgejo Action in the user and admin sections. They are associated with examples and tests that help understand how they actually work.

A round of updates was also done by harvesting documentation improvements from Codeberg and from Gitea.

Forgejo Actions

Runner 3.0.1

A number of actions (e.g. checkout@v4) now depend on node 20 which was only recently supported by ACT on top of which the Forgejo runner is based. The Forgejo runner 3.0.1 contains that upgrade.

The cascading-pr action

Forgejo is not a mono-repository project. It is made up of several software projects that have their own release cycle in multiple repositories. Synchronizing them is sometimes challenging, as demonstrated by the rather involved test instructions of the Forgejo runner.

To simplify the development workflow a new action was developed. cascading-pr can be used in the workflow of a repository to verify that a proposed change won't break anything when a dependent software upgrades. For instance, when a pull request is opened in the Forgejo runner, a workflow will also open a pull request in setup-forgejo.

If the CI passes on setup-forgejo, it is an additional confirmation that the proposed change in Forgejo runner does not contain a regression that would break setup-forgejo once released.

Governance and communication

Gitea copyright assignment

Code contributions to Gitea now require a copyright assignment. It does not impact the most trivial bug fixes because they are not subject to copyright. But it means that it is not enough for a contribution to be released under the MIT license, all copyright headers must also be removed.

This new requirement was discovered when the Forgejo security team contributed the fix for the Long-term Authentication security issue explained above. It contained files with a Copyright Forgejo header in addition to the Copyright Gitea header and was blocked for that reason. The author of the patch agreed under protest to remove their copyright headers for the sake of Gitea admin security.

FOSDEM 2024

Plans are made to organize a Forgejo and Codeberg presence at FOSDEM 2024. If you would like to participate, feel free to reach out in the development chatroom.

Moderation

The moderation team currently has just one person, which is problematic when they are involved in a moderation action. A new member proposed their participation to remedy this.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo Security Release 1.20.5-0

Fri, 06 Oct 2023 00:00:00 GMT

Today Forgejo v1.20.5-0 was released.

This release contains an important security fix that adds protection to prevent a malicious actor from impersonating Forgejo users by using a copy of the database, as described below.

This release also contains bug fixes, as detailed in the release notes.

Recommended Action

We strongly recommend that all Forgejo installations are upgraded to the latest version as soon as possible.

Long term authentication token

Impersonation

Given a copy of the Forgejo database, a Long-term authentication token can be constructed for any user and used to impersonate them. Such a token does not expire LOGIN_REMEMBER_DAYS days after it was created and remains valid for as long as users do not change their password.

The construction of such a token does not involve any kind of brute-force or cracking, it only requires the values as stored literally in the database.

Protection

The former implementation was inherently insecure, because it allowed the Long-term authentication token to be constructed from the database alone. It is reworked to require additional information from the user cookie. The idea is derived from a 2015 blog post where it is explained in more detail.

Responsible disclosure to Gitea

On 6 July 2023 the Forgejo security team notified the Gitea security team that the mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. A possible solution was suggested together with a more detailed explanation. We requested a 90 days embargo, after which a patch to the v1.20 point release could be published.

Contribute to Forgejo

Forgejo v1.21 release candidates

Fri, 22 Sep 2023 00:00:00 GMT

Today the first release candidate for the upcoming Forgejo v1.21 release was published. It is meant for testing only: do not upgrade a production instance with it.

Beside a number of improvements to Forgejo Actions (variables, cron, disabling workflows, artifacts cleanup, auto-cancellation of concurrent jobs, multiple artifacts and more), the most prominent new features are:

Newly pushed branches show in the web UI with a link to create a PR.
Improved issue search.
Admins can be notified via email when a new user registers to help fight spam bots.
Labels that are no longer useful can be archived. They can no longer be selected but they remain on existing issues.
When a PR contains multiple commits, it is now possible review to each commit independently.
In addition to the cron jobs defined to cleanup packages, it is now also possible to trigger the cleanup manually.
The CODEOWNERS file is interpreted to automatically set reviewers on PRs.
To improve performances, branch information is now cached in a database table.

The draft release notes will be completed in the following weeks. Make sure to check the breaking changes and get your production instance ready for when the v1.21 release is available.

There also was progress regarding federation with the F3 driver and its CLI (an essential building block to synchronize forges with each other) but nothing is ready for experimenting yet.

Try it out

The release candidate is published in the dedicated "experimental" Forgejo organization and can be downloaded from:

Containers at https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/1.21
Binaries at https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v1.21.0-0-rc0

Check out the v1.21 documentation section for detailed installation instructions.

It will be updated based on your feedback until it becomes robust enough to be released.

Help write good release notes

The best release notes are meant to articulate the needs and benefits of new features and the actions recommended for breaking changes so Forgejo admins quickly know if it is of interest to them.

The current draft release notes are still incomplete. They will be finished by the time the release is published and you can help make them better.

Contribute to Forgejo

If you have any feedback or suggestions for Forgejo, we'd love to hear from you! Open an issue on the issue tracker for feature requests or bug reports. You can also find us on the Fediverse, or drop by the Matrix space (main chat room) to say hi!

Forgejo monthly report - September 2023

Thu, 21 Sep 2023 00:00:00 GMT

The lifecycle of Forgejo v1.20 is coming to an end and v1.21 is entering the release candidate phase this week. In addition to work on the codebase a lot also happened on the website, the documentation and the Forgejo runner.

Judging from the activity of Forgejo contributors, there is every reason to believe this new release will go smoothly. No-one is overworked or stressed, dependencies are up to date, features are added, the technical debt is kept in check and it looks like it could go on forever. But that should not hide the fact that there are many areas where progress could happen if only there were more contributors.

The past month was again dominated by the aftermath of the storage settings regressions but this unfortunate episode is, at last, concluded. It was a lesson for everyone involved on how to manage bugs that require action from the Forgejo admins because they cannot be fixed with a new release and an unattended upgrade. The recipe is simple enough but also quite time consuming: understand the problem, write tests to verify the conclusions, clearly explain what happened and provide detailed recovery recommendations.

Development

Fixing S3 configuration bugs and regressions

The storage configuration regressions fixed with the Forgejo v1.20.3-0 release were verified with newly introduced upgrade tests. They were focused on local storage and assumed S3 configuration was not subject to the same issues.

This assumption was not verified with any test and turned out to be wrong. A Forgejo instance setup to use garage instead of MinIO faced two simultaneous issues blocking the upgrade: the storage unexpectedly went from being in the filesystem to S3, and the S3 backend failed to initialize. The failure to initialize was a rather simple error in the settings, hidden behind a non human readable error message. With a configuration change, the Forgejo instance was upgraded successfully.

To help other Forgejo admins running into these bugs the storage documentation was updated with examples and references. The recommendations in the Forgejo v1.20.3-0 blog post were also extensively updated to address both S3 and local storage. They were verified with more upgrade tests that do the following for a variety of storage configurations:

start an S3 server
start a Forgejo instance at a given version
upload objects into all subsystems (avatars, packages, attachments, etc.)
verify they are found where they are supposed to be

The upgrade tests are run before each pull request is merged. They can also be extended to identify breaking changes between major Forgejo versions and verify the recommended actions to deal with them are accurate.

Changing the update time of issues via the API

The pull request to allow for setting the update times of issues and comments via the API was merged. It is one of the most fragile commits in Forgejo and was made significantly more robust with an extensive set of tests.

When upgrading Forgejo dependencies, Forgejo can be impacted in two ways:

the API or the codebase changed and Forgejo won't compile
there is no conflict but the behavior changed in an incompatible way, and Forgejo tests will fail

The Forgejo codebase is organized in a set of about 100 commits (as of today) and heavily relies on tests during upgrades. It allows maintainers to focus on meaningful problems instead of spending their valuable time manually verifying, over and over, the same features keep working.

User blocking

When a user tries to transfer a repository to a user or organization that has blocked them, that transfer is denied. Pre-existing transfer requests are also denied when the user is blocked. Read more in the moderation section of the documentation.

See all moderation pull requests.

Publishing development versions

A few months ago it was proposed to publish Forgejo development versions on a weekly basis. This has happened in the past month and is what https://next.forgejo.org is running. The version number is something like vX.Y.Z-test, to clearly state it is not to be used for real.

Federation

The F3 Forgejo driver entered a new development phase. It goes like this:

forgejo-cli f3 mirror is run for upload or download on an existing repository
a bug shows and is fixed either in:
- the gof3 package
- the Forgejo driver
repeat

It is still experimental.

See all F3 pull requests.

CURL based Forgejo client

forgejo-curl.sh is a new thin curl wrapper that helps with Forgejo authentication. Beyond that it does not provide anything. It is low maintenance because it only relies on the authentication logic and does not need updating when the REST API (or the web UI endpoints) change.

Website and documentation

Astro was upgraded to version 3, and further improvements were made to the file layout to further separate content from code.

A number of small improvements were made, including a switch to system fonts to improve performance and fix a layout issue which sometimes caused scroll anchors to misbehave.

The documentation content was moved to its own dedicated repository to ease contribution and separate the content from the website code.

Detailed instructions are now provided for working locally on the documentation. Tooling is available to preview the results before sending a PR, and to fix linting errors. A Git hook helps to ensure badly-formatted content is not committed, and the Forgejo Actions CI helps to apply checks to the content before PRs are merged, as well as helping to backport changes to older versions of the docs where necessary.

Creating previews for documentation PRs without exposing secrets is not a trivial problem. Some CI have a setting to take the risk. But Forgejo Actions does not work that way and that requires a different strategy, similar to what is used when publishing Forgejo releases in order to protect the release signing key. It depends on a feature that will only be available in v1.21 and it needs more manual work in the meantime.

Forgejo Actions

The actions supporting the Forgejo runner release process are grouped into a new repository, forgejo-build-publish. The build phase and the publishing phase. They are not new actions, they were copy/pasted from the Forgejo main repository, generalized to also be usable for the runner and verified with integration tests.

The new version of the Forgejo runner that came out of this new release process has binaries named differently than before and unified with the Forgejo binary naming scheme.

The container image already existed but was not supported or thought through. It is now tested and documented with a standalone docker-compose example that is verified to work.

The container image only contains the runner binary and does not run as root. The docker-compose example shows there is no need for anything else, even when using docker:dind.

Infrastructure

The infrastructure as well as the runner backends rely on LXC system containers and use lxc-helpers.sh to implement patterns common to Forgejo. Among other things, it sets the permissions of the container to run docker, nested LXC or libvirt but lacked flexibility to:

Add more permissions to run a kubernetes cluster
Restrict permissions for better isolation

The new --config option provides a range of pre-defined permissions to remedy that problem. It includes k8s which is tested to work when installing k3s.

Governance and communication

Contributors team

The Forgejo "contributors" team was created informally and liberally to grant permissions to label issue, manage CIs and pull requests etc. To make it official it was formally proposed in the governance repository to be decided according to the decision making process.

Debconf23

There were discussions about Forgejo at Debconf23 and a contributor to FreedomBox was interested in packaging Forgejo for Debian so that it can be distributed with FreedomBox. They could join the forgejo-deb which already provides functional Debian GNU/Linux packages.

Sustainability

A new discussion started on how to absorb the workload from the Forgejo issue tracker. There is no conclusion or action planned and the problem unfortunately remains. However, Codeberg independently sent a call for help to get help with handling their scaling issues and it will hopefully attract more contributors to Forgejo.

The second payment of the NLnet grant was received. In total 40% of the workplan approved for the grant in June 2023 was implemented.

Moderation

Earlier this year ad-hominem attacks were published in the Forgejo spaces. This goes against the Forgejo Code of Conduct and some of these messages were redacted. The author repeatedly refused to acknowledge this was not an acceptable behavior in Forgejo spaces and recently sent threats to publish more ad-hominem attacks. Read more in the moderation report.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo Security Release 1.20.3-0

Mon, 21 Aug 2023 00:00:00 GMT

Today Forgejo v1.20.3-0 was released.

This release includes safeguards in case [storage].PATH is set or conflicting storage sections are found in the app.ini file. For instance if both [storage.packages] and [packages] exist, the directory in which the packages are stored may change after the upgrade. Forgejo will refuse to upgrade from v1.20.2-0 (or an earlier version) if the sanity checks fail and require manual intervention to avoid data loss, as described below.

It also contains a security fix that prevents leaking emails via the API.

Technical details of these bug fixes are available in the release notes.

UPDATE: this blog post was updated early September 2023 for Forgejo instances using S3 for storage. If you have read the previous version, please take a look at the diff.

Recommended Action

We recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

Fixing the risk of data loss related to `[storage*]` sections

A manual action is required to avoid the risk of losing data if:

the app.ini file contains one or more [storage*] sections that are as follows:
- [storage].PATH is set
- [attachment] and [storage.attachments] exist
- [lfs] and [storage.lfs] exist
- [avatar] and [storage.avatars] exist
- [repo-avatar] and [storage.repo-avatars] exist
- [repo-archive] and [storage.repo-archive] exist
- [packages] and [storage.packages] exist
the app.ini file contains STORAGE_TYPE = minio
you are currently currently running:
- A Forgejo version lower than v1.20.3-0
- A Gitea version lower than v1.21

If this is not the case this chapter does not concern you and can be skipped.

Bug description

The storage configuration in the app.ini file was refactored in v1.20 and bugs were introduced. There were also bugs in the previous implementation and all versions up to Forgejo v1.20.2-0 are impacted.

These bugs are best explained through an example. By default the files for each subsystems - Attachments, LFS, Avatars, Repository avatars, Repository archives, Packages - are stored in a dedicated directory. For instance if APP_DATA_PATH is set to /data, the directory layout looks like this:

/data/attachments
/data/lfs
/data/avatars
/data/repo-avatars
/data/repo-archive
/data/packages

But if the app.ini file contains the following section and no other storage related sections:

[storage]
PATH = /my/storage

all subsystems will share /my/storage instead of having their own directory. The attachments will be stored in the /my/storage directory, together with the avatars, the repository archives, etc.

Bug impact

Subsystems sharing a directory

If [storage].PATH exists in the app.ini file it may cause some subsystems - Attachments, LFS, Avatars, Repository avatars, Repository archives, Packages - to share the same directory.

It may not create a problem immediately and can go unnoticed for an extended period of time. But since each subsystem was designed to have a dedicated directory it will eventually:

Create a name clash when one subsystem tries to use the same files as another subsystem
Permanently destroy data when one subsystems delete files from another subsystem

One example of permanent data loss is when clicking on Delete all repositories' archives (ZIP, TAR.GZ, etc..) in the system administration web page: it will not only delete the archives but also attachments, LFS files etc.

Misplaced data

When two sections related to a subsystem are found in the app.ini file (for instance [packages] and [storage.packages]), the location in which the data is stored may change in an unpredictable way after the upgrade to v1.20.3-0.

Prior to Forgejo v1.20, using STORAGE_TYPE = minio in some contexts was ignored and the files were actually found in local storage (for instance the [repo-archive] section as demonstrated by this test).

The Forgejo instance will no longer find the files stored in the previous location and it will start populating the new location. As time passes there will be no way to reconcile the content of the two locations that diverged in this way.

Relative paths inconsistencies

When the path to a local storage location does not start with a /, it is interpreted to be relative to another path. Unfortunately the logic changed across versions, as demonstrated by an extensive set of tests going back to Forgejo v1.18.5-0.

For instance if app.ini contains [storage.lfs].PATH = somedir it will end up in:

APP_DATA_PATH/lfs for Forgejo v1.19.4-0
WORK_PATH/somedir for Forgejo v1.20.2-0
APP_DATA_PATH/somedir for Forgejo v1.20.3-0

Recommended action

Forgejo supports two storage backends: the file system (the default or when STORAGE_TYPE = local is set) and S3 compatible storage (when STORAGE_TYPE = minio is set). To figure out where each subsystem stores its files before the upgrade, grep the Forgejo logs as shown in the following example:

$ grep -e 'New.*Storage()' -e 'Initialising.*storage' < forgejo.log
:initAttachments() [I] Initialising Attachment storage with type:
NewLocalStorage() [I] Creating new Local Storage at /data/gitea/attachments
:initAvatars() [I] Initialising Avatar storage with type:
NewLocalStorage() [I] Creating new Local Storage at /data/gitea/avatars
:initRepoAvatars() [I] Initialising Repository Avatar storage with type:
NewLocalStorage() [I] Creating new Local Storage at /data/gitea/repo-avatars
:initLFS() [I] Initialising LFS storage with type: minio
NewMinioStorage() [I] Creating Minio storage at 127.0.0.1:9000:forgejo with base path lfs/
:initRepoArchives() [I] Initialising Repository Archive storage with type:
NewLocalStorage() [I] Creating new Local Storage at /data/gitea/repo-archive
:initPackages() [I] Initialising Packages storage with type:
NewLocalStorage() [I] Creating new Local Storage at /data/gitea/packages
:initActions() [I] Initialising Actions storage with type: minio
NewMinioStorage() [I] Creating Minio storage at 127.0.0.1:9000:forgejo with base path actions_log/
:initActions() [I] Initialising ActionsArtifacts storage with type: minio
NewMinioStorage() [I] Creating Minio storage at 127.0.0.1:9000:forgejo with base path actions_artifacts/

NOTE: when a Forgejo container is configured using variables such as -e FORGEJO__storage__PATH=/my/storage, it will create an app.ini file that contains [storage].PATH. Removing this variable will not remove the section from the app.ini file, it has to be done manually.

Follow the instructions below to update your app.ini so that the storage locations stay the same. Keep in mind that some manifestations of these bugs are not covered by the sanity checks preventing an upgrade that may have an impact on the storage location. For instance when relative paths are used in the app.ini file or other corner cases that have not been discovered yet.

If you have any doubt about the following steps or if you suspect the storage directories are merged together as described above, file an issue or reach out to the chatroom to get help.

Before upgrading to Forgejo v1.20.3-0
Save the output of grep -e 'New.*Storage()' -e 'Initialising.*storage'
For each local storage, add a section to app.ini, replacing the PATH value with the absolute path of the directory for each subsystem. Check the table in the documentation to find the correspondence between the name of the subsystem displayed in the logs and the section in the app.ini file. For instance, the subsystem Attachment is associated with the [attachment] section:
```
[attachment]
PATH = /my/storage/attachments
```
For each minio storage, add the following to app.ini, replacing the MINIO_BASE_PATH value with the base path found in the logs (see the grep example above). Check the table in the documentation for a correspondence between the name of the subsystem displayed in the logs and the section in the app.ini file. For instance, LFS needs:
```
[lfs]
STORAGE_TYPE = minio
MINIO_BASE_PATH = mylfs/

MINIO_ENDPOINT = 127.0.0.1:9000
MINIO_ACCESS_KEY_ID = [redacted]
MINIO_SECRET_ACCESS_KEY = [redacted]
MINIO_BUCKET = forgejo
MINIO_LOCATION = us-east-1
```
Remove the [storage] section from app.ini
Remove the [server].LFS_CONTENT_PATH entry from app.ini (it is the default for [lfs].PATH)
Remove the [picture].AVATAR_UPLOAD_PATH entry from app.ini (it is the default for [avatar].PATH)
Remove the [picture].REPOSITORY_AVATAR_UPLOAD_PATH entry from app.ini (it is the default for [repo-avatar].PATH)
Merge the settings found in related sections together as follow:
- move the settings found in the [storage.attachments] section into the [attachment] section and remove it (one plural, the other singular)
- move the settings found in the [storage.lfs] section into the [lfs] section and remove it
- move the settings found in the [storage.avatars] section into the [avatar] section and remove it (one plural, the other singular)
- move the settings found in the [storage.repo-avatars] section into the [repo-avatar] section and remove it (one plural, the other singular)
- move the settings found in the [storage.repo-archive] section into the [repo-archive] section and remove it (both singular)
- move the settings found in the [storage.packages] section into the [packages] section and remove it (both plural)
Upgrade to v1.20.3-0 or a later version
Verify each subsystem uses the expected storage with grep -e 'New.*Storage()' -e 'Initialising.*storage

Bug fix and data recovery

After upgrading to v1.20.3-0 the storage settings can be used as explained in the documentation. But there is unfortunately no way to automatically repair an existing instance impacted by these bugs during the upgrade.

To address this problem:

v1.20.3-0 and later will refuse to upgrade from v1.20.2-0 (or an earlier version) if the sanity checks fail. Upgrading without manual verification would be taking the risk of silently changing the location in which a subsystem expects to find its files. The data would not be lost because it would still exist in the former location, but Forgejo will not find it any more. The new location will start being populated in a way that may be impossible to reconcile with the content of the former location.
v1.20 point releases from v1.20.3-0 and later will refuse to downgrade to v1.20.1-0 or v1.20.2-0. Although it is usually possible to downgrade from a point release to a lower point release, it is forbidden in this case to protect the Forgejo instance from any risk of data loss.

NOTE: A recovery strategy to separate directories that were previously merged together can be to duplicate the merged data into the target directories. There can still be name clashes and it only works for local storage if the amount of data is not too large.

Get Forgejo v1.20

See the download page for instructions on how to install Forgejo, and read the release notes for more information.

Upgrading

Carefully read the breaking changes section of the release notes.

The actual upgrade process is as simple as replacing the binary or container image with the corresponding Forgejo binary or container image. If you're using the container images, you can use the 1.20 tag to stay up to date with the latest 1.20.x point release automatically.

Contribute to Forgejo

Forgejo summer update - July & August 2023

Thu, 17 Aug 2023 00:00:00 GMT

Publishing Forgejo v1.20 was the highlight of these past few weeks and also required more time than the previous major releases. The new features are the most attractive part of the announcement but most of the work went into listing and explaining the breaking changes in the release notes. They have to be as clear as possible for Forgejo admins asking themselves: does it matter to me? What should I do then? Unfortunately a few issues were missed and one of them caused a downtime when upgrading Codeberg. A robust and durable solution was developed as a followup.

Meanwhile the development quietly went on, a project to produce Debian packages entered the Forgejo contrib organization, the website was reorganized internally, new documentation chapters were created, the hardware infrastructure did not cause any trouble and the Codeberg moderation dealt with spam bots efficiently. Are these signs that Forgejo is a healthy project? Definitely. Does this mean someone willing to help would be turned down because there is nothing else to do? Absolutely not! If you are serious about creating a world where Free Software can be developed with Free Software, step in, your help is needed.

Forgejo v1.20

Forgejo v1.20 was published 24 July 2023 and there are reasons to be happy about the new features described in the blog post. And also by the fact that the entire release process is now based on Forgejo Actions. It is a challenging release for Forgejo admins because there are many breaking changes. A lot of attention went into ensuring a seamless experience when upgrading from any Gitea version, v1.20 included, and there has been no report of failed upgrades so far.

Codeberg was successfully upgraded to Forgejo v1.20.2-0 on 10 August 2023 after a few tests of database upgrades. In the days prior to the upgrade, Forgejo contributors and Codeberg volunteers worked together to figure out the potential issues and prepare the ground. A mail was sent to all users a few days before, warning them to re-create their personal access tokens in order to ensure their scope were not unexpectedly modified. This was the most prominent breaking change since it required all users to be aware of its impact.

Shortly after the upgrade all packages became unexpectedly unavailable and the feature was disabled while investigating. It turned out to be a regression caused by conflicting storage settings in the app.ini file and the problem was fixed a few hours later. The lesson was learned and the Forgejo v1.20.3-0 release will include a safeguard against that particular issue. Other bugs (with less impact) were discovered and some of them were fixed right away (profile rendering, auth icons ratio, dropzone filename hidden, ...).

Development

In addition to the development areas discussed below, it is worth mentioning there has been an unprecedented amount of pull requests proposed and merged to fix bugs or implement features such as OpenStreetMap links in profiles, banning dots in usernames or unifying project views. A number of these changes were contributed back to Forgejo dependencies to keep the Forgejo codebase size to a minimum.

Federation

A pull request started a few months ago to allow for setting the update times of issues and comments via the API is now two tests away from being merged. It matters to federation because mirroring an issue from one forge to another so it can be displayed requires the dates are preserved which is not currently possible.

The F3 driver for Forgejo now relies on the gof3 CLI instead of implementing its own. It was made possible by a refactor of gof3 that uses urfave/v2 to be compatible with Forgejo. This kind of factorization reduces the redundant work required to maintain independent projects and keeps their combined codebases DRY.

The new forgejo-cli f3 mirror subcommand will do what it suggests: mirrors projects, issues, pull requests, etc. from one forge to the other. The implementation is not complete but made progress together with tests.

Storage settings regressions

Around 6 August work started to deal with a difficult problem regarding storage settings (see the final draft blog post if you are reading this before it is published). There are multiple cascading issues:

The bug is found in all Forgejo releases
Upgrading to a release fixing the bug requires manual intervention
Implementing a safeguard has to be done before the database upgrade and after loading the settings but there is no logic to do that
The safeguard has to prevent downgrading from a point release but the information about the previously running Forgejo instance is not available
Testing the safeguard can only be done reliably with automated upgrade tests which do not exist

A solution for those issues was implemented and backported to v1.20. It was almost done when the Codeberg upgrade to v1.20 happened on 10 August and discovered one manifestation of the bug that was overlooked (conflicting [packages] and [storage.packages] sections). It was an unfortunate oversight but had the benefit of improving the fix to be released in v1.20.3-0.

Codeberg hit the issue shortly after extensive manual upgrade testing was conducted. All of which had to be repeated after fixing the newly found issue. It was a great example of why manual testing is generally a bad idea and eventually more time consuming than writing automated tests. Instead of running the upgrade tests manually again, automated upgrade tests were implemented. Although they launch multiple versions of Forgejo a dozen times, they run under five minutes.

Semantic Version

The Forgejo semantic version was used when implementing the storage setting sanity checks. It is not yet used for releases or public facing Forgejo version numbering. But it can be used internally.

Moderation

When a user is blocked and is also a collaborator on a repository that the blocker owns, that collaboration is removed.

Publishing development versions

It was proposed to publish Forgejo development versions on a weekly basis. Although this was done as a byproduct of the weekly Forgejo rebase in August, the discussion is still ongoing. They are only for experimentation and could be used to run https://next.forgejo.org which is meant to help figure out if a bug is happening in the most recent development branch.

Forgejo contrib

The forgejo-contrib organization is where projects related to Forgejo can find a home while they are being developed or when the long term maintenance is uncertain.

Debian packages for Forgejo

The Debian packages for Forgejo project moved to forgejo-contrib. The packages it provides use the Debian package registry that was introduced in Forgejo v1.20.

Helm chart for forgejo

A pull request was proposed to the Helm chart for forgejo to deploy the Forgejo runner alongside Forgejo. The offline registration implemented in Forgejo and the runner were designed to help that particular use case.

Website and Documentation

The website was restructured to use Astro content collections to better separate content from the source and improve maintainability over the ad-hoc system previously in use. There also were smaller changes such as custom 404 pages.

Now that v1.20 was published, the v1.21 documentation was created to receive updates that are not relevant to v1.20 such as the new moderation features.

A table of content was added to help navigate large pages and preparations were made to move the documentation into a separate repository.

New workflow for stable releases

The Forgejo development branch is rebased weekly and that worked out nicely for almost a year. The same was done until last month for stable branches. It also worked well but had one confusing side effect: the tags of the stable versions could not be found in the stable version branch. For instance the v1.93.3-0 tag is not on a commit found in the forgejo/v1.19 branch. Although it did not seem to create any actual problems, it is unusual and cause for confusion.

Early July a proposal was made for a different workflow to address this issue. It has been adopted when the first v1.20 release was published and the v1.20.1-0 and v1.20.2-0 are now both found in the forgejo/v1.20 branch.

Infrastructure

There has been no issue with any of the hardware in the Forgejo infrastructure. It is worth mentioning resources used daily for the CI and the releases did not cause trouble.

This kind of stability is taken for granted when relying on cloud providers but it does not happen magically. Their staff is hard at work to maintain a stable environment over time. Forgejo chose to rely on Free Software only and runs its own hardware. Part of the infrastructure is using an OpenStack provider, similar to AWS but based on a Free Software stack and API. The rest is running on dedicated LXC hypervisors.

Being independent from cloud providers running proprietary software means more work for Forgejo community members. But since Free Software is one of the core values of Forgejo, it is also a requirement. The promise is to deliver a Free Software codebase but also to ensure it can be developed and released in a Free Software environment. The big question is: can the Forgejo devops team durably maintain a reliable and secure infrastructure? It is too early to tell but over four weeks of uninterrupted and stable service is a very positive sign.

Governance and communication

Wikidata

Wikidata acts as central storage for the structured data of its Wikimedia sister projects including Wikipedia, Wikivoyage, Wiktionary, Wikisource, and others. Forgejo has an entry which was thoroughly updated. The Forgejo releases are also listed and updated by Wikidata editors when they are published.

Sustainability

The NLnet grant is progressing and some tasks related to the release process were completed. A "Requests for Payment" was approved and another is pending. The relationship between NLnet and Forgejo is not a contract in the traditional sense and a "Request for Payment" is the equivalent of an invoice, only it is paid to the beneficiary as a charitable donation. In this case the payment will go to Codeberg e.V.

Time is as valuable as funding and Forgejo durability heavily depends on how much time volunteers are willing to devote to moderation, sorting bugs, fixing them etc. It is, in fact, arguably the most precious resource any Free Software project has. The time spent by one volunteer was added to the sustainability repository to account for that. It is not a requirement and each volunteer decides whether or not they want their time to be accounted for in this way.

Moderation

With the upgrade to Forgejo v1.20, the self-moderation features are available on Codeberg and were used to enforce the ban decided on 17 March 2023 for a period of one year.

Two spam bots posted a dozen messages that have been sent via email to people watching the Forgejo repositories. The bots were removed by the Codeberg moderation team before the incident was even noticed by the Forgejo moderation team.

A moderation report was published and reminds Forgejo community members that "nobody can, under any circumstances, unilaterally decide to reveal private information in Forgejo spaces. It does not only go against one of the core values of Forgejo, it also goes against the most basic expectation for privacy of every person entering Forgejo spaces".

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo v1.20 is available

Mon, 24 Jul 2023 00:00:00 GMT

Forgejo v1.20.1-0 is here and you will find the most interesting changes it introduces below. Before upgrading it is strongly recommended to make a full backup as explained in the upgrade guide and carefully read all breaking changes from the release notes. If in doubt, do not hesitate to ask for help on the Fediverse, or in the chat room.

Actions: the internal CI graduated from experimental to alpha and is now used by Forgejo to verify pull requests and to create releases, including this one. It comes with a user documentation that includes examples and an extensive administrator guide to set it up.
User profile: the Forgejo home page for a user can now be a Markdown file instead of the list of repositories they own.
New markdown editor: the editor used when creating issues, adding comments, etc. is now GitHub markdown.
Blocking users: is a new self-moderation tool a user or an organization can use to prevent users from interacting with the repositories they own.
Pinned issues: it is now possible to select issues and pull requests to show on top of the list.
Registries: additional registries are now available for SWIFT, debian, RPM, alpine, Go and CRAN.
API endpoints: new API endpoints are now available for email, renaming a user, issue dependencies management, activity feeds, license templates, gitignore templates, uploading files to an empty repository, creating a branch directly from commit, label templates, changing/creating/deleting multiple files.

Forgejo Actions

Although Forgejo Actions is not yet production ready, it became good enough for Forgejo itself to use in production. It verifies pull requests (see also the testing workflow), builds and publishes releases (this one and the release candidates before it).

It is still considered alpha stage because:

the Forgejo runner is not secure enough
a single Forgejo runner will poll Forgejo every two seconds by default which is not scalable
some errors only show in the Forgejo runner logs and not in the Forgejo user interface which is not a good user experience

The potential security bugs are a concern and Forgejo took the following precautions to reduce the risks in its own infrastructure.

Do not trust any web application with secrets. The Forgejo release process needs a GPG private key to sign the binaries before they are uploaded. A web application with a large attack surface such as Forgejo or GitLab must not be trusted to keep such a secret safe. Instead a Forgejo instance dedicated to signing the releases was installed behind a VPN.
LXC containers confinement. All Forgejo runners are deployed in dedicated LXC containers and re-installed from scratch from time to time.

In addition, the required pull request approval prevents unknown users from triggering a task that would include a malicious workflow.

User profile

By default the profile page of a user is the list of repositories they own. It is possible to customize it with a short description that shows to the left, under their avatar. It can now be fully personalized with a markdown file that is displayed instead of the list of repositories.

New markdown editor

The web editor used when creating issues, adding comments, etc. changed from EasyMDE to GitHub markdown. To help with the transition it is still possible to switch back to using EasyMDE with the double arrow button in the menubar.

This new markdown editor does not provide any WYSIWIG features. As shown in the demo it is merely a helper for users who are not familiar with markdown.

Want to add a list? Click on the list menu item and see that a star is inserted for you. Select a word and click the bold button so it is surrounded by two stars. Nothing fancier. By comparison the EasyMDE editor has more features such as showing in bold the word that is surrounded by two stars.

Unfortunately it is no longer actively maintained and enough has long standing bugs to justify a replacement.

Blocking users

On large Forgejo instances with ten of thousands of users it may be challenging for the moderation team to properly address all requests. The most common one being a malicious user spamming issues with advertisements or unwanted noise. It will be immediately noticed by the repository owner and it may take a while for the moderation team to act.

The owner of a repository or an organization can now block a user as soon as they notice an undesirable interaction. When they go to the profile page of the user, a new Block button shows on the left.

After confirmation the user will be added to the list of blocked users.

From the Blocked Users tab in their profile, the user can unblock them when the relationship gets better.

The user being blocked is not notified and does not see any difference until they try to participate in a repository from which they are blocked. Their action will fail with a message informing them they have been blocked.

Pin issues

Issues and pull requests can be pinned and will show on top of the list of issues (or pull requests). They can be re-arranged by dragging them.

Theming and custom templates

The themes and templates changed a lot in this release and there is no documentation explaining how and why. The hope is that the users will discover the changes and not be overly confused.

This is also a reminder that Forgejo considers themes and templates to be a part of the internals and require an understanding of the source codebase to be modified and adapted after each release. In other words, if a Forgejo admin extracted templates and modified them on a v1.19 instance they will need to read the source code to figure out how they need to be modified to keep working with v1.20.

Federation

Does Forgejo support federation? Not yet. Was there progress? Yes.

The monthly report has details on these progress and the State of the Forge Federation: 2023 edition published last month explains how Forgejo fits in the big picture.

Forges have existed for twenty years and none of them has achieved data portability let alone federation. Forgejo is yet to celebrate its first birthday and it will take it a little time to get there. One thing is for sure: at this point no other forge is doing concrete work in this direction.

Get Forgejo v1.20

See the download page for instructions on how to install Forgejo, and read the release notes for more information.

Upgrading

Carefully read the breaking changes section of the release notes.

The actual upgrade process is as simple as replacing the binary or container image with the corresponding Forgejo binary or container image. If you're using the container images, you can use the 1.20 tag to stay up to date with the latest 1.20.x point release automatically.

Contribute to Forgejo

Forgejo monthly report - June 2023

Fri, 07 Jul 2023 00:00:00 GMT

Forgejo v1.20 is around the corner: release candidates were published and most of the activity went into testing them, updating the documentation and rebuilding the release process. Although Forgejo Actions is not yet considered production ready, it proved stable enough to be used for all Forgejo development and releases. It did not always go smoothly and there were challenging times when a hardware failure and a Denial of Service (DoS) attack disrupted the work during a week.

Forgejo does not do much of anything in terms of communication but got its first Wikipedia page and was mentioned in the State of the Forge Federation: 2023 edition. There is a great need for contributors who have strong skills that do not involve writing code, even beyond spreading the word about Forgejo, such as writing documentation, organizing video-conferences, etc. Codeberg allocated funds to Forgejo that could be used to compensate contributors willing to help but who cannot afford to be volunteers.

Development

Forgejo v1.20

The first release candidates for Forgejo v1.20 were published. The highlights are:

The internal CI/CD known as Forgejo Actions is now used by Forgejo itself and the Forgejo Runner for testing pull requests and publishing releases. It is still in beta stage and disabled by default but it is stable and secure enough to be activated on Forgejo's own instance. An extensive admin and user documentation is available.
The User Interface (UI) and User eXperience (UX) changed significantly and will require some adjustment from users who will have to adapt to a different layout. And admins who created their own templates and styles will need to figure out, by reading the sources, how it evolved.
New API endpoints were added (activity feeds, renaming users, uploading file, retrieving commits, etc.).

The draft release notes are mostly complete but they still work and contributions would be most welcome.

Publishing one of the release candidates was made specially difficult because Codeberg suffered from a hardware failure that was followed by a DoS attack. It took about a week instead of a few hours. A similar situation happened in the early days of Forgejo, when the first release was only half published because the process unexpectedly broke at the wrong time. The release process was refactored on that occasion to be resilient to network and hardware failures. This effort paid off this time around, when the release process had to be restarted no less than a dozen times over three days until it finally succeeded.

Moderation

An API was implemented to manage blocked users in organizations and user accounts.

Federation

When artifacts (repositories, issues, etc.) are imported in Forgejo, they are now associated with a user that acts as a placeholder if it does not already exists. If that same user authenticate themselves on Forgejo via OAuth at a later time, this placeholder will be promoted to a real user.

In other words, if a repository that belongs to Jane Doe is federated from GitLab to a Forgejo instance, she will be able to reclaim it as soon as she registers via OAuth2 on the Forgejo instance. The OAuth2 authorization from GitLab is proof enough that she is the legitimate owner of this repository.

Documentation

The Forgejo documentation is a patchwork from various sources (Codeberg, Gitea, etc.) as well as content authored by Forgejo contributors. To improve the documentation for the Forgejo v1.20 release a full pass was done to get relevant updates from these sources. In addition a new section was created with Recommended Settings and Tips.

The Forgejo Actions admin guide is complete and the user guide got better but still requires a significant work to be finished. An effort is made to include examples that are part of the CI of actively maintained repositories so they can be verified to work.

Forgejo Actions

A new version of the Forgejo runner was published to fix bugs and security issues. Although it is stable and runs for weeks uninterrupted, it is best confined on an isolated machine that is reset on a regular basis for security reasons.

There has been no report of security issues when enabling actions in Forgejo v1.19 and Codeberg decided to enable it. That allowed for a simpler release process based on Forgejo Actions for both Forgejo and the Forgejo runner to be implemented. It was used to publish all release candidates in the experimental organization and helped fine tune it.

The Woodpecker CI release process was still used to publish the latest v1.19.4-0 release. It was retired and moved to its own repository as of Forgejo v1.20.

Governance and communication

Wikipedia

Earlier than expected, Forgejo got its first Wikipedia page. It still needs secondary sources to be inserted to durably establish its notoriety but it has not yet been challenged and those can easily be added.

State of the Forge Federation: 2023 edition

In the State of the Forge Federation: 2023 edition published 21 June Forgejo plays a central role.

Late 2022 Forgejo, a new forge with a focus on federation was created. Dozens of people contributed to its making and it is now used in production by ten of thousands of users at Codeberg, Disroot, etc. This large and unforeseen undertaking diverted the energy of most contributors set to work on federation features [...]. [...] the foundations on which forge federation is being built have shifted and there is reason to hope it was for the best.

Matrix archive bot

The privacy expectations of people visiting the Forgejo chatrooms is not high: they are fully aware they are publicly available and that anyone can visit them.

But even in this context the sudden appearance of an archive bot from Matrix.org surprised a number of active participants. The bot was banned while the situation was discussed. A few weeks later Matrix.org shut down this service. Forgejo community members were likely not the only ones to protest.

Governance

There has been some discussions about how teams are useful and why but no significant progress was made on governance otherwise.

Hardware

In addition to the hosting provided by Codeberg, Forgejo needs a very secure hardware to host the cryptographic keys used to sign releases as well as the most sensitive work of the security team. It also occasionally needs to run resource consuming Continuous Integration jobs, for instance when performing end to end testing to verify a release can actually be used in a production environment. Or when hardware emulation is required to verify multi-architecture binaries run as expected.

A new hardware was acquired and is being configured. It suffered intermittent failures that took significant time to figure out during the first week and was eventually replaced. These investigations were an opportunity to confirm that the stack on which Forgejo hardware is deployed is solid (Debian GNU/Linux and LXC). There was little doubt about it since Codeberg uses the same. But when a machine reboots randomly multiple times per day for not apparent reason and all hardware tests confirm it should not, it is a motivation to doubt about everything.

The security team now uses resources hosted behind a VPN at octopuce.forgejo.org to work together in a secure environment.

Roadmap

Forgejo is still in the process of defining its roadmap, a concrete strategy to move forward with federation, scaling and robustness.

The NLnet grant that was awarded last month demanded a workplan. This provides some clarity about what the beneficiaries are set to accomplish in the following areas:

UI and accessibility improvements
DNS-Update-Checker RFC
Cleaner Webhook system
A new continuous integration agent
Tools to produce a source distribution and multi-architecture Forgejo binaries
An integrated release pipeline based on Forgejo

It is not a roadmap just yet, but it can help create one.

Funding

During its General Assembly, Codeberg decided to allocate funds to Forgejo and ideas are welcome to decide how they should be spent.

A funding opportunity was discovered to raise as much as 600K€ with an amount of administrative work well suited for small companies. No application was sent by the deadline (6 July). However there is another opportunity, with a 31 July deadline.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo v1.20 release candidates

Sat, 10 Jun 2023 00:00:00 GMT

Today the first release candidate for the upcoming Forgejo v1.20 release was published and the documentation updated. It is meant for testing only: do not upgrade a production instance with it.

The highlights are:

The internal CI/CD known as Forgejo Actions is now used by Forgejo for testing and releasing the Forgejo Runner. It is still in its infancy and disabled by default but it is stable and secure enough to be activated on Forgejo's own instance. The documentation was updated to explain how to install and use it.
The User Interface (UI) and User eXperience (UX) changed significantly and will require some adjustment from users and admins who created their own customized templates.
New API features and endpoints were added (activity feeds, renaming users, uploading file, retrieving commits, etc.).
Essential sub-systems were refactored (the queue system that handles background tasks such as checking pull requests, the logger used to display Forgejo's logs, ...). In theory these changes are transparent to the Forgejo user and admin but the risk of subtle regressions is real: do not hesitate to reach out if you suspect anything.

The draft release notes have a categorized list of the most significant changes:

[A11Y] accessibility of the web interface.
[API] REST API.
[AUTH] authentication.
[CI] Forgejo's own Continuous Integration.
[MODERATION] moderation tools.
[PACKAGES] package registries.
[REFACTOR] internal refactors.
[RSS] display and creation of RSS feeds.
[TEMPLATES] templating system used to create web pages, issues, mails, etc.
[TIME] time localization and readability.
[UI / UX] User Interface and User eXperience.
[WEBHOOK] webhooks and notifications triggered when something happens in Forgejo.
[WIKI] wiki features.

Make sure to check the breaking changes (look for the string BREAKING) and get your production instance ready for when the v1.20 release is available.

There was progress regarding federation with the integration of the F3 driver in the codebase (an essential building block to synchronize forges with each other) but nothing is ready for experimenting yet.

Try it out

The release candidate is published in the dedicated "experimental" Forgejo organization and can be downloaded from:

Containers at https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/1.20
Binaries at https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v1.20.0-0-rc0

Checkout the v1.20 documentation section for detailed installation instructions.

It will be updated based on your feedback until it becomes robust enough to be released.

Help write good release notes

The best release notes are meant to articulate the needs and benefits of new features and the actions recommended for breaking changes so Forgejo admins quickly know if it is of interest to them.

The current draft release notes are still incomplete. They will be finished by the time the release is published and you can help make them better.

Contribute to Forgejo

Forgejo monthly report - May 2023

Wed, 07 Jun 2023 00:00:00 GMT

Forgejo was awarded grant from https://nlnet.nl/ which will allow Codeberg e.V. and community members to get funding for improving the Forgejo release process and develop additional features, starting June 2023. It complements the on-going grant dedicated to federation: the features it will provide can only be deployed if releases are published and tested to work in a secure environment.

The Codeberg moderation team is facing daily challenges that are a heavy burden. A new feature was implemented to allow users to block someone in the repositories they own, allowing them to mitigate some of the most common problems. This not only helps relieve the pressure on the moderation team of any public Forgejo instance, it also is an essential building block for federation because it creates more opportunities for unwanted attention.

Development

Forgejo depends on Gitea and over a hundred other Go packages. But Gitea is not provided or designed as a package and that creates unique challenges when upgrading, which is done on a weekly basis. Forgejo developed workflows since its inception to reduce the workload.

Every automated test reduces the scrutiny required from Forgejo contributors when upgrading Gitea. This is specially challenging when dealing with the authentication system because it has almost no test coverage. A mechanism to allow for dependency injection in integration tests was added as well as a simple OAuth2 test to demonstrate how to use it.

When upgrading Forgejo, database migrations are applied using a set of files and a sequential numbering to ensure their consistency. Forgejo specific database modifications cannot conveniently be inserted in that sequence. Instead, a separate migration directory was created and manages a set of tables prefixed with forgejo_. It was used in the implementation of the user blocking feature.

User moderation feature

Moderation features now have their dedicated feature branch. It will contain tools that fall in two categories: self-service to help users in the simpler cases and helpers for a dedicated moderation team with admin privileges who take care of the entire Forgejo instance.

The first to land was user blocking and organization level blocking is in progress. Blocking another user is desirable if they are acting maliciously or are spamming your repository.

Documentation

A new section was added to the documentation with a very detailed explanation of how to install and setup Forgejo using a binary. And also minimal install instructions for container images.

Two other sections were also added for the admin and user documentation of Forgejo Actions. It is still work in progress but provides the basics to get started and replaces the older blog post.

Forgejo Actions

A CI configuration for Forgejo was created based on Forgejo Actions. Although it has been tested to work, the Woodpecker CI is still used to validate pull requests. It will be run in parallel as soon as Codeberg enables Forgejo Actions.

Forgejo extensively uses LXC in the Forgejo runner. A set of shell scripts named lxc-helpers were developed, tested (with Forgejo Actions) and documented in a separate repository. They are now used in various other contexts (the setup-forgejo action or the Ansible playbooks used to deploy Forgejo hardware).

The Forgejo runner saw more releases and is turning more secure (releases are now GPG signed), stable and configurable.

Simpler and more secure release process

The release process was revisited, taking the opportunity of the brand new Forgejo runner to do so. In a nutshell it is a set of Forgejo Actions workflows that behave differently depending on the variables/secrets that are available. The repository is automatically mirrored in different organizations (experimental, integration, release) that have different variables/secrets to perform their expected role.

Here is how it goes for the Forgejo runner:

when in the forgejo-integration organization, build the release
when in the forgejo-release organization, safely hosted behind a VPN, use the GPG release key & secrets to sign and copy the release that was created in the forgejo-integration organization to publish the binary release and the container image

Hardware

The devops team completed the deployment of the new hardware at octopuce.forgejo.org. It is now in production and part of the new release process that was used to produce the latest releases of the Forgejo runner. It provides a VPN for the release team to secure the last step which involves a workflow to sign the binaries.

Funding

The NLnet grant application focused on producing quality Forgejo releases that are essential for federation to happen was granted. It will provide funding to Codeberg e.V., https://codeberg.org/oliverpool, https://codeberg.org/crystal and https://codeberg.org/earl-warren for their work starting in June 2023. It complements the on-going grant that provides funding for developing moderation features.

The general assembly of Codeberg e.V. renewed its support to Forgejo and decided to allocate funding in 2023 to further Forgejo.

Reconciliation and Moderation

The archive@matrix.org bot entered the Forgejo chatrooms and started operating. Some Forgejo community members did not approve and asked the moderation team to ban it. A discussion began and will be concluded by a decision to accept or reject this bot.

A few months ago a chatroom was created and is dedicated to the reconciliation of Forgejo community members. Making peace after a dispute is not easy but it happened and sets an example that will hopefully inspire more reconciliations. Until that happens the moderation team offers to act as a buffer between community members so they can contribute to Forgejo, working side by side without being forced into stressful interactions.

Licensing

Following the decision that Forgejo will accept copylefted contributions, a blog post was published to explain the reasoning. The next step is an agreement to accept contributions compatible with GPLv3-or-later.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo welcomes copyleft contributions

Tue, 06 Jun 2023 00:00:00 GMT

Developers who choose to publish their work under a copyleft license are excluded from participating in software that is published under a permissive license. That is at the opposite of the core values of the Forgejo project and it was decided to also accept copylefted contributions. Will this change anything for Forgejo users? Not a thing since they already use and install one of the most successful copyleft software alongside Forgejo: Git. Will this change anything for Forgejo developers? Not a thing since they can keep contributing under the license of their choice. Just like Git, Forgejo will be copyleft.

Forgejo users already welcome copyleft

Forgejo is a software forge, an online development environment, based on Git. Both Forgejo and Git must be installed together, either as individual binaries or bundled into the official container images. The license of Git is GNU GPLv2 which is a copyleft license. Although the Forgejo codebase includes basic support for go-git, a Go package distributed under a permissive license that can be used in place of Git, it is not supported or packaged because it is not fully compatible and could corrupt Git repositories.

There are legal obligations attached to copyleft software which are, in a nutshell, to offer the source code with the binary under the same license. For instance, if an employee was to distribute a Git binary to someone else, the organization they work for can be required to also provide the complete and corresponding source. And if they fail to do so, they may loose all their rights under the license, at least until the copyright holders agree to grant them back. For this reason some organizations exclude copyelfted software entirely. However, when they use Git, it means the legal counsel has no objection to copylefted software.

What will change in Forgejo?

The license of Forgejo will change to be copyleft when a copylefted work is merged. The most likely candidate is, for instance, when a Go package is discovered that provides an interesting functionality.

Before it happens a decision will be made by the community to choose a copyleft license, in accordance to the Forgejo decision making process. The chosen license will apply to Forgejo as a whole (binary and sources) but each file within the codebase will retain its own license. This is nothing new as Forgejo already includes various licenses and contributors are expected to agree to the Developer Certificate of Origin.

Developers who feel strongly about exclusively publishing their work under a permissive license can keep doing so when working on Forgejo. By the terms of this permissive license, they accept that their work can be sublicensed and redistributed under a proprietary license. And they also accept that it can be sublicensed and redistributed as part of Forgejo, under a copyleft license.

Forgejo monthly report - April 2023

Sat, 20 May 2023 00:00:00 GMT

Codeberg upgraded to Forgejo v1.19 and, as can be expected from the largest instance in existence, hit a performance issue which was dealt with quickly.

The security of Forgejo actions and the release process was a strong focus. It is critical for Forgejo actions to be used in production safely: a random Codeberg user must be able to rely on the CI by submitting a pull request without putting the underlying infrastructure at risk. A solution based on LXC is implemented. To improve the security of the release pipeline, the devops team is deploying a Forgejo instance and runner on a dedicated hardware behind a VPN to sign the binaries.

There also are noteworthy activities in the wider Forgejo community not covered in this update.

Forgejo v1.19 point releases

Three point releases were published (1.19.1-0, 1.19.2-0 and 1.19.3-0).

Codeberg.org waited until Forgejo v1.19 proved to be stable enough to upgrade. It did not go smoothly because of a performance issue. However, a diagnostic and a workaround were found and applied within 24h. This problem impacts all Forgejo v1.19 instances but was only noticed in Codeberg.org because of its scale. It will be properly fixed in the next point release.

To make them easier to digest for the Forgejo administrators and users, the release notes now have detailed explanations of the most prominent changes. This is specially useful for security fixes to better understand their impact and evaluate the urgency of the update on a case by case basis.

The Forgejo semantic version is included in the release notes as a reminder that it can be used for scripting to automatically identify a release that includes a breaking change and avoid unexpected downtime.

A step towards federation

For federation to happen, Forgejo instances must be able to mirror each other. It is different from being able to migrate a project from one instance to another. The F3 reference implementation, which is still in development stage, will allow for mirroring a single issue as well as an entire project.

A F3 driver was developed for Forgejo and merged into the development branch. It is not ready for experimenting but it passes some integration tests and will be part of the weekly round of rebase together with the other Forgejo feature branches.

Forgejo actions progress

As an experimental feature, Forgejo actions keeps improving. The Forgejo runner saw a few more releases, using itself in a nicely recursive way.

It is developed on code.forgejo.org which runs Forgejo v1.19 and includes a CLI that allows it to obtain a registration token: forgejo actions generate-runner-token. It was not documented or advertised which led to confusion when it was changed to match the Gitea implementation that came later. It is fine when a feature is experimental. But it was a reminder that care must be taken when introducing new features in Forgejo so they do not conflict with Gitea and other dependencies.

LXC is confirmed to be a good option for job isolation. The runner is based on ACT which is designed to run jobs on a local machine and assumes its user is trusted. When running a job from a pull request authored by less trusted users, their ability to use docker as a mean to access files from the host becomes problematic. One option is to spawn a dind on every job. Another is to run the job in LXC.

Hardware infrastructure

The devops team was appointed in accordance to the decision making process. It is responsible for the day to day operations of https://code.forgejo.org, https://next.forgejo.org and https://forgejo-ci.codeberg.org.

A new hardware at octopuce.forgejo.org is being deployed and provides a VPN for the release team to secure the last step which involves a pipeline to sign the binaries. It reduces the attack surface compared to using a public facing Forgejo instance to do the same. It will first be used for releasing the Forgejo runner and, when stabilized, Forgejo itself.

Grant applications

The NLnet grant application focused on producing quality Forgejo releases that are essential for federation to happen was accepted to the next step. This is the last one and it will few weeks before the final decision is known.

Moderation team

The moderation team now has one member. All moderation actions are bound to the moderation process for transparency and audit by the Forgejo community.

Licensing

It was decided on principle that Forgejo would accept copylefted contributions. Before it happens a decision will need be made on the choice of a license. Until then the licensing terms of Forgejo are not modified.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo monthly report - March 2023

Mon, 10 Apr 2023 00:00:00 GMT

Forgejo v1.19 was published. It is the first major upgrade and was a critical milestone to verify the development strategy of the soft fork actually works. The release team was legitimized by the community in accordance to the decision making process, as promised when Forgejo was created.

Forgejo Actions, the experimental integrated CI, now runs on the new Forgejo infrastructure which includes two instance. One for experimenting and debugging and another dedicated to Forgejo development. In a spirit of dogfooding, the Forgejo runner that spawns CI jobs is now released using Forgejo Actions. A new action, setup-forgejo was also created to conveniently spawn a Forgejo instance for the duration of a test.

There also are noteworthy activities in the wider Forgejo community not covered in this update.

Forgejo v1.19 release

On 21 March 2023 Forgejo v1.19 was released. It was challenging to figure out how the new documentation and additional binaries required for Forgejo Actions fit in.

The documentation is versioned and maintained in a directory that has the same name as the Forgejo release
The Forgejo runner is released independently and tested to be compatibility with existing Forgejo releases

Forgejo v1.19 includes all of Gitea v1.19 and the upgrade went smoothly. If Gitea was a Go package with a documented API it would be as easy as upgrading one of the other Forgejo dependencies. But it is not and that's where the difficulty of a soft fork resides.

The Forgejo strategy, since its inception, is to rebase on top of Gitea weekly. The Forgejo commit series are kept to a minimum (for instance by squashing related commits) and conflicts, if any, are resolved (for instance changing from less to css required reworking the commit implementing the Forgejo themes). It turns out to be sustainable and the associated maintenance work stays the same over time. Considering that hundreds of commits have been merged in Forgejo over the past four months, there were many opportunities for a rebase to go wrong and get stuck because of conflicts. The absence of problems during the Forgejo v1.19 release is a sign that this strategy is working.

When Forgejo started, people stepped up to create the releases. There was no decision making process at the time and no clear way for the community to agree that they could be trusted with this role. They were part of an interim governance and pledged to resign as soon as a governance was in place. They fulfilled this promise 2 March 2023 by applying to become legitimate members of the Forgejo release team in accordance to the decision making process. They got an agreement a few weeks later and there now is a Forgejo release team agreed upon by the Forgejo community.

A dedicated Forgejo infrastructure

next.forgejo.org

A volatile Forgejo v1.19 instance dedicated to trying new features and demonstrate bugs is now running at https://next.forgejo.org. It is linked from the website and in the bug report template.

code.forgejo.org

The experimental integrated CI that comes with Forgejo v1.19 is not just a new feature, it also depends on:

a new binary, Forgejo runner, that is responsible for running the CI jobs
a repository of reusable Free Software Actions

They both need to be tested and it would be convenient if Forgejo Actions was enabled on Codeberg. There would be no need for Codeberg to provide a runner: it can be run and connected independently, using a token specific to a given repository. Forgejo would spawn a runner and it would work without requiring any resource from Codeberg. However, there are at least two reasons for waiting until Forgejo v1.20 or v1.21 before enabling this feature on Codeberg, even without providing runners to Codeberg users:

it is still experimental and fragile
it may have security issues

To solve that problem an instance of Forgejo was installed at https://code.forgejo.org. It has a registration open to Codeberg users and is dedicated to Forgejo related development. It has Actions enabled and provides a runner to selected repositories.

The devops team

These machines need devops and applications to the devops team are in progress. Their role is, in a nutshell, to keep all machines Forgejo depends on in a healthy state. That includes the new machine made available to the Forgejo project, which could be used to host code.forgejo.org.

Dogfooding Forgejo Actions

Forgejo provides some essential Actions in a dedicated organization. As one can expect of any function in Go or Python, Actions are not immune to typos, regressions or subtle misbehavior, just like the software they are designed to test. Testing is even more important in a distributed environment where each Action is maintained by different groups of people and have their own lifecycle.

The CI of the Forgejo Runner itself relies on workflows that use actions for:

Running unit tests
Publishing its own releases
Integration testing to verify it performs as intended with a live Forgejo instance

The Forgejo Runner integration tests uses a new setup-forgejo action. It runs a Forgejo instance for the duration of the test, very much like a MySQL or PostgreSQL service. It can conveniently be used by software that depends on Forgejo, for instance to test interactions with the Forgejo API instead of relying on mocks.

The setup-forgejo action uses itself, recursively, for integration testing with two levels of nesting:

Forgejo 0: https://code.forgejo.org is a Forgejo instance that hosts setup-forgejo.
Forgejo 1: when a pull request is proposed setup-forgejo, the CI job creates a brand new Forgejo instance with a runner to experiment with the proposed change.
Forgejo 2: The experiment consists of running setup-forgejo and verify the Forgejo instance it creates actually works as expected.

This is made possible by enabling LXC system containers in the runner. With the additional benefit of allowing systemd to run, installing docker instead of dind etc.

The Forgejo Community is healing

In February 2023 someone new (who wasn't a contributor that the project is relying on) joined the chat and issue tracker, spoke repeatedly in ways that was hurtful/painful to Forgejo community members, and did not seem to have capacity to speak more sensitively, despite offers for support and repeated requests. It was eventually decided to remove this person from the project during a year. But the tension they created did not dissipate instantly. In March 2023 it distracted community members from productive and important work on governance, strategy and development. Some community members went silent, others were on edge and more moderation actions were taken.

It is in the nature of inclusive communities to be subject to that sort of trouble in their infancy, when they are still fragile. Some can be destroyed for good, others may choose to be less inclusive to better protect the members of their inner circles. Something different is happening in Forgejo. Late March it went back to be the quiet and productive space it once was. Community members who were silent during the troubles came back. A moderation process was proposed and was field tested. It is a little early to be sure but it appears the community is healing and is now better protected from negative influence, without sacrificing on inclusiveness.

Grant applications

As a followup to questions sent by NLnet on a grant application to create a Forgejo distribution, potential beneficiaries worked on a detailed project plan. It was sent late March and it will take a few weeks before a reply is received to determine if it is allowed to proceed to the next step.

Another grant application focused on improving Forgejo UI/UX was declined.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo v1.19 is available

Tue, 21 Mar 2023 00:00:00 GMT

Forgejo v1.19.0-2 was released. It comes with an extensive user guide, derived for the most part from the Codeberg documentation. The new admin guide covers upgrades and configuration of Forgejo instances.

The most prominent new features are:

Actions: an experimental CI/CD, although not ready for real world usage, is present and can be used to run a demo.
Incoming emails: you can now set up Forgejo to receive incoming emails. When enabled, it is possible to reply to an email notification from Forgejo and (i) add a comment to an issue or a pull request, (ii) unsubscribe to notifications.
Scoped access tokens: Forgejo access token, used with the API, can now have a "scope" that limits what it can access.
Package registries now support Cargo, Conda and Chef.

Get Forgejo v1.19

See the download page for instructions on how to install Forgejo, and read the release notes for more information.

Upgrading

Carefully read the breaking changes section of the release notes.

The actual upgrade process is as simple as replacing the binary or container image with the corresponding Forgejo binary or container image. If you're using the container images, you can use the 1.19 tag to stay up to date with the latest 1.19.x point release automatically.

The Forgejo instances built from an incorrect tag can safely be upgraded.

Contribute to Forgejo

If you have any feedback or suggestions for Forgejo, we'd love to hear from you! Open an issue on our issue tracker for feature requests or bug reports, find us on the Fediverse, or drop into our Matrix space (main chat room) and say hi!

Forgejo gets an integrated CI named Actions

Mon, 27 Feb 2023 00:00:00 GMT

Prior to Forgejo v1.19 running CI jobs required a third party software such as Woodpecker CI. It has its own web interface, relies on webhooks to be notified something changed in a repository and relies on the Forgejo API to figure out user permissions or access to private repositories. When it is finished, the error or success is also sent back to Forgejo via the API, with a link the user needs to click to get more details. It works well enough and Forgejo has been using Woodpecker CI from day one, for testing pull requests or publishing releases.

With v1.19 comes an experimental CI (not ready for production just yet) integrated in Forgejo. The CI jobs are configured with a syntax that is similar to GitHub Actions:

# .forgejo/workflows/demo.yaml
name: Demo
run-name: ${{ github.actor }} is testing
on: [push]
jobs:
  Explore-CI:
    runs-on: ubuntu-latest
    steps:
      - run: echo "The job was automatically triggered by a ${{ github.event_name }} event."
      - run: echo "This job is now running on a ${{ runner.os }} server."
      - run: echo "The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
      - name: Check out repository code
        uses: actions/checkout@v3
      - run: echo "The ${{ github.repository }} repository has been cloned to the runner."
      - run: echo "The workflow is now ready to test your code on the runner."
      - name: List files in the repository
        run: |
          ls ${{ github.workspace }}
      - run: echo "This job's status is ${{ job.status }}."

And the results are displayed in the Forgejo web interface:

Try it out

WARNING: The following procedure was effective for setting up a test instance when early versions of the Forgejo runner were under development, but the details are now outdated. Precompiled runner binaries are available and you should refer to the Forgejo Actions administrator documentation for runner setup instructions.

Create a Forgejo v1.19 instance with the user root password admin1234

docker run --name forgejo -e FORGEJO__security__INSTALL_LOCK=true -e FORGEJO__actions__ENABLED=true -d codeberg.org/forgejo-experimental/forgejo:1.19
docker exec --user 1000 forgejo forgejo admin user create --admin --username root --password admin1234 --email root@example.com

Get the IP of the Forgejo instance (172.17.0.2 in the following)
```
docker exec --user 1000 forgejo ip a
```
Login at http://172.17.0.2:3000/ with user root password admin1234
Create a test project and activate actions in the settings
Get the runner token from the runner tab in the Site administration (mytoken in the following)

git clone https://codeberg.org/forgejo/runner
cd runner
git checkout v1.1.0
make build
./forgejo-runner register --name myrunner --no-interactive --instance http://172.17.0.2:3000 --token mytoken
./forgejo-runner daemon

Add the .forgejo/workflows/demo.yaml file above to the test repository, via the web interface
Go to the Actions tab of the project and watch it run to completion

How does it work?

The forgejo-runner creates a docker container and runs the job inside it. It can be shell commands (e.g. ls ${{ github.workspace }}) or actions (e.g. uses: actions/checkout@v3). The actions are references to repositories that are cloned and executed. For instance actions/checkout will clone https://codeberg.org/actions/checkout.

The container image used to run the container is specified by runs-on: ubuntu-latest but it may not contain all the tools required to complete the job. Reason why some actions are allowed to create a new container based on other images. In the end a single job may involve running multiple containers and they are all terminated when the job completes.

Limitations

The implementation is very new and has many limitations which makes it unfit for production.

There is no support to run services such as a Postgres database
The container running the job is not systemd capable
There is no guarantee of compatibility with GitHub Actions, although the syntax of the files and the terminology is similar

Under the hood

The Forgejo runner is a new addition to the Forgejo dependencies (git & ssh) and is not yet packaged, it must be built from sources as explained above. It is a thin layer on top of ACT which implements the core of the logic to interpret and run the jobs. A soft fork of ACT is used and contains commits that are not yet submitted or accepted upstream.

Forgejo v1.19 release candidates

Mon, 27 Feb 2023 00:00:00 GMT

Today Forgejo v1.19.0-0-rc0 was released. It is meant for testing only: do not upgrade a production instance with it.

The draft release notes contain a summary of the new features. The highlights are:

Incoming emails
Scoped labels
Package registries now support for Cargo, Conda and Chef. They also have new cleanup rules and quota limits.
Any webhook can now specify an Authorization header to be sent along every request.

The Actions experimental CI/CD, although not ready for real world usage, is also present and can be used to run a demo.

Make sure to check the breaking changes and get your production instance ready for when the v1.19 release is available.

Try it out

The release candidate is published in the dedicated "experimental" Forgejo organization and can be downloaded from:

Containers at https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/1.19
Binaries at https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v1.19.0-0-rc0

They will be updated based on your feedback until they become robust enough to be released.

Help write good release notes

The best release notes are meant to articulate the needs and benefits of new features and the actions recommended for breaking changes so Forgejo admins quickly know if it is of interest to them.

The current draft release notes contain a complete inventory but the descriptions are still incomplete. They will be finished by the time the release is published and you can help make them better.

Please submit your own descriptions and comments in our issue tracker.

Contribute to Forgejo

Forgejo Security Release 1.18.5-0

Thu, 23 Feb 2023 00:00:00 GMT

Today Forgejo v1.18.5-0 was released.

This release contains an important security fix for Forgejo to raise the protection against brute force attack on hashed passwords stored in the database to match industry standards, as described below.

This release also contains bug fixes, as detailed in the release notes.

Recommended Action

We strongly recommend that all Forgejo installations are upgraded to the latest version as soon as possible.

If PASSWORD_HASH_ALGO is explicitly set in app.in, comment it out so that the stronger algorithm is used instead.

All password hashes stored with another algorithm will be updated to the new algorithm on the next usage of this password (e.g. a user provides the password to the Forgejo server when they login). It does not require manual intervention.

High CPU usage after the upgrade

The default password hashing in Forgejo now takes 32 times more CPU time. If the CPU usage is too high after the upgrade, the easiest workaround is to revert to the previous hash algorithm by adding the following in app.ini:

[security]
PASSWORD_HASH_ALGO = pbkdf2_v1

The real solution is to reduce the use of passwords in git commands or API calls and switch back to the default hash algorithm for better protection.

Reducing the performance impact

Codeberg hosts ~60,000 projects for ~50,000 users and provided real world data to evaluate the performance impact of using a hash algorithm that requires 32 times more CPU than before.

Password hashing happens when users login, sign up or reset their passwords. Even on a busy instance such as Codeberg it does not happen frequently enough to cause performance problems.

It is also possible that passwords are used in other contexts:

git commands, e.g. git clone https://user:password@forgejo.example.com/owner/repo/
API calls, e.g. curl https://user:password@forgejo.example.com/api/v1/version

They can be replaced by alternative authentication methods:

git commands can use SSH keys, e.g. git clone git@forgejo.example.com:owner/repo
API calls can use access tokens, e.g. curl -H 'Authorization: token xyz' https://forgejo.example.com/api/v1/version

It will be faster for the user because the hashing adds a delay. And it will significantly reduce the CPU usage on the Forgejo server.

Understanding password hashes

Brute force attacks

The user provided passwords are hashed before they are stored so they are not readable in case a copy of the database is leaked. The hash value stored in the database cannot be translated into the original password. But there exists large databases of common passwords and a program can patiently try to hash them one after the other, hoping to find a match. If the hash algorithm is fast, this brute force attack may succeed quickly. If the hash algorithm is expensive to run, it may take so long and use so much resources that it is not worth a try.

In other words, if a malicious person gets a copy of a Forgejo database, the complexity of the hash algorithm is the only thing preventing them from brute forcing it.

Industry standards

The industry adapt the recommendations for the hash algorithms as new hardware provide more processing power and make it easier to brute force. The default algorithm for Forgejo is PBKDF2-HMAC-SHA256 and the OWASP recommendations in December 2022 were:

use PBKDF2 with a work factor of 310,000 or more and set with an internal hash function of HMAC-SHA-256.

This security upgrade sets the iterations (work factor) to 320,000 and will be revised on a regular basis. Although the default for Forgejo is PBKDF2 and the upgrade consists of modifying its parameters, other algorithms such as argon2id may be preferred in the future.

Access tokens

In order for a brute force attack on a password hash to succeed, there must be a match in a database of common passwords. Since the access tokens are randomly generated by the Forgejo server, they are highly unlikely to be in such databases. That makes them, by nature, very resistant to brute force attacks.

Responsible disclosure to Gitea

On 8 February 2023 the Forgejo security team notified the Gitea security team that the default hash algorithm was significantly weaker than the industry standard, explained the associated risks and provided a patch to upgrade the hash algorithm to 320,000 iterations. An embargo was then negotiated until 16 February 2023, after which the v1.18 point release could be prepared.

Contribute to Forgejo

Forgejo Security Release 1.18.3-2

Fri, 17 Feb 2023 00:00:00 GMT

Today Forgejo v1.18.3-2 was released.

This release contains a security fix for Forgejo container images, as described below. When Forgejo runs from a binary, recommendations to upgrade the git version installed alongside it are also provided.

This release also contains bug fixes as detailed in the release notes.

Recommended Action

We recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When using a Forgejo binary: upgrade the git package to a version greater or equal to v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7 or v2.30.8
When using a Forgejo container image: docker pull codeberg.org/forgejo/forgejo:1.18.3-2

Security issues in Git

Git recently announced new versions to address two CVEs (CVE-2023-22490, CVE-2023-23946). On 14 February 2023, Git published the maintenance release v2.39.2, together with releases for older maintenance tracks v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8.

The Forgejo security team analyzed both CVE and concluded that they cannot be exploited via Forgejo. It is however recommended to upgrade git as a precaution.

Fixing Git when using a Forgejo binary

Fixing Git when using a Forgejo container image

When installed as an image downloaded from the Forgejo registry, the container includes both the Forgejo binary and the git binary, as obtained from Alpine 3.16. Forgejo 1.18.3-1 contains a vulnerable git binary:

$ docker run --rm codeberg.org/forgejo/forgejo:1.18.3-1 git --version
git version 2.36.4

The Forgejo 1.18.3-2 images were built shortly after the patched git binary was upgraded in Alpine 3.16 and is not vulnerable:

$ docker run --rm codeberg.org/forgejo/forgejo:1.18.3-2 git --version
git version 2.36.5

In this case it is necessary to upgrade Forgejo to 1.18.3-2 to get the fixed git binary. The rootless variant of Forgejo also includes the git binary and can be upgraded in the same way.

Forgejo installation instructions

See the download page for instructions for installation instructions. If you are upgrading from Forgejo 1.18.3-1 (or Gitea 1.18) no manual action is required. If you're on Gitea v1.17.x or older please read the release notes carefully, and in particular check out the breaking changes section of Gitea's blog post.

The actual upgrade process is as simple as replacing the Gitea binary or container image with the corresponding Forgejo binary or container image. If you're using the container images, you can use the 1.18 tag to stay up to date with the latest 1.18.x point release automatically.

Contribute to Forgejo

Source tree tags v1.18.1-0, v1.18.2-0, v1.18.2-1, v1.18.3-0 and v1.18.3-1 were fixed

Mon, 13 Feb 2023 00:00:00 GMT

TL;DR: Skip this blog if you run a Forgejo instance using the binaries or container images downloaded from https://codeberg.org/forgejo

The symptoms

A Forgejo instance is:

unexpectedly running v1.19 despite the version string indicating v1.18
refusing to start after upgrading the package (Arch, etc.) to version >= v1.18.3-1

The problem before 11 February 2023

The v1.18.1-0, v1.18.2-0, v1.18.2-1, v1.18.3-0 and v1.18.3-1 binaries and container images are v1.18 as advertised
The v1.18.1-0, v1.18.2-0, v1.18.2-1, v1.18.3-0 and v1.18.3-1 tags did not match and were actually set on the development branch

Because of a bug in the release process, the tag of each release was actually set to the tip of the Forgejo development branch at the time of the release. Because Forgejo is a soft-fork, it matched the latest Gitea development branch and had all the Forgejo improvements on top of it. But the Forgejo binaries and container images were created using the v1.18 stable branch.

The problem is fixed on 11 February 2023

The problem was fixed 11 February 2023 ~7am UTC by force pushing the v1.18.1-0, v1.18.2-0, v1.18.2-1, v1.18.3-0 and v1.18.3-1 tags and nothing else. The binaries and container images were good and remain the same.

The consequences

A Forgejo binary built from sources by checking out one of the tags before 11 February 2023 will be running the development branch v1.19 instead of the expected v1.18 branch. Some packages, such as the official Arch Linux package, are also built from the tags and therefore contain Forgejo v1.19 instead of Forgejo v1.18.

The version displayed at the bottom left of the home page will incorrectly be v1.18* instead of v1.19* because it is created at build time using the name of the tag. But there is one difference in the home page that allows you to distinguish them, on the large logo in the center:

On v1.19 there is an alt="logo" attribute
On v1.18 there is no such attribute

A v1.19 Forgejo instance cannot be downgraded to v1.18. It will refuse to start because there is no safe downgrade path.

Recommended actions

Forgejo admins: wait for v1.19

If your current instance unexpectedly runs v1.19, the recommendation is to not upgrade and wait.

Forgejo v1.19 will be released in a few months and the easiest workaround for a Forgejo admin running an instance built from source or installed from a package built from source is to wait until then before upgrading.

Forgejo instances installed from Arch package < v1.18.3.1-1

For those running Arch Linux (or a derivative such as Manjaro or Arch Linux ARM), our current recommendation is to add forgejo to the IgnorePkg list in /etc/pacman.conf until v1.19 is released.

For those who have already upgraded, we recommended downgrading your package to v1.18.3.0-1 as this is the latest version that exhibited this issue. You may be able to find the package for this version in your pacman cache. If the file is not in your pacman cache, it can be downloaded from the Arch Linux archive.

Alternatively, the downgrade utility from the AUR can help with installing an older version and adding Forgejo to IgnorePkg. This tool automates the process above with one command.

When Forgejo v1.19.0-0 is released, you should remove forgejo from IgnorePkg in /etc/pacman.conf and take the upgrade.

If you installed the package after v1.18.3.1-1 was released, your installation is not affected by this issue.

Package authors: (re)build v1.18.3-1

If a package was built using one of the tags above, build (or rebuild if the build happened before 11 February 2023) based on the current tag v1.18.3-1 with hash 4e5be58493 so that future installations are not affected by the problem.

It also means the existing installations will not be able to upgrade. Forgejo will refuse to start because they were really running v1.19 before upgrading. The package should be labeled as such with link to this blog post in the changelog to explain why it happens.

Get in touch, you will get help

If none of the recommended actions work for you, please get in touch at contact@forgejo.org or in the development chatrooom to get help. This was a bug and you deserve all the help you can get. Getting in touch will also help us improve this blog post if needed.

Forgejo monthly report - January 2023

Tue, 31 Jan 2023 00:00:00 GMT

Forgejo 1.18.0-1, the first release, was published 29 December 2022, followed by patch releases which included security fixes. There were no reports of failed installations or upgrades. The 15 December 2022 announcement made a promise and a lot of work went into fulfilling it. A release is more than uploading a file and hoping for the best, users deserve reliable distribution channels and it requires dedicated people and proper tooling. Forgejo proved to be a product that users can rely on for their day to day operations, from large instances such as Codeberg to personal ones running on low-end hardware.

What goes into each Forgejo release is a snapshot taken from an constantly evolving patchwork of Free Software components carefully assembled together. It is based on Gitea, which is itself built on one hundred packages, and when digging deeper it amounts to almost a thousand. But wait, there's more: container images include git, ssh and rely on Docker. The CI runs on Woodpecker with LXC and Debian GNU/Linux. This is why adding a feature or fixing a bug in Forgejo often means contributing to one of its many dependencies. This is the healthy way to grow the global Free Software ecosystem. For instance, an LXC backend was contributed to Woodpecker to improve the Forgejo release process. If a proprietary CI was used, such a contribution would not be possible and progress would be blocked. Another example is the accessibility improvements that were contributed to Gitea.

The Forgejo community is made of people who are citizens of the larger Free Software ecosystem. They may identify themselves as members of the Forgejo community because they like that it furthers the interest of the general public. Or because they enjoy participating in a democratically led community. Or when they write a piece of code somewhere in the thousands of Forgejo dependencies. It is not an elite community, it is not an affinity group; it is an inclusive and fluid group of people who share values and visions. It is engaged in work to define its governance, make sensible decisions and preserve a safe space in accordance to its Code of Conduct.

Forgejo 1.18

From a technical point of view, Forgejo is a drop-in replacement for Gitea: it can be used without any modification by simply replacing the Gitea binary (or container image). On 29 December 2022 Forgejo v1.18.0-0 was released and had just a little glitch: the version number started with a w instead of a v. The same day Forgejo v1.18.0-1 was published to fix that mistake.

This typo was the tip of the iceberg: the release process had to be redesigned. Back then, it took more than one hour for the Forgejo release process to complete. Furthermore it could be interrupted when a release was partially published, throwing the rest away. Unfortunately, that happened while releasing v1.18.0-0 and a clever workaround to resume with a version starting with a w created an artifact. That could have been problematic, or at the very least raise an eyebrow from Forgejo admins.

In the following weeks, a two-phase process was created wherein the releases are first built in the Forgejo integration organization and published there as drafts, to be thrown away if anything goes wrong. This is the most time-consuming step and also the one that is most likely to fail because something was overlooked by the Forgejo developers or because of an unexpected environmental failure. The second phase is copying the release to its final destination; although it is not atomic, the window of opportunity for a half published release is significantly smaller.

Security releases

The security team was quickly put to the test and had to prepare two Forgejo releases (Forgejo v1.18.1-0, 18 January and Forgejo v1.18.2-1, 22 January). The problems were explained in plain English for Forgejo admins to quickly understand their impact and assess the urgency of an upgrade. Handling security issues responsibly is a heavy burden and while the process in place proved to work effectively on those two occasions, it will require a continuous effort for as long as Forgejo exists.

Although it did not put Forgejo users at risk, there were problems during the making of these security releases, as can be expected for any newly formed team. The expectations were not clearly laid out, the security@forgejo.org mail was a redirection that revealed the recipients under some circumstances, unencrypted messages were exchanged, security issues were not always reported responsibly and embargo requests were overlooked. Although it worked out fine in the end and all these issues were properly addressed, it speaks to the challenges of bootstrapping a security team.

Accessibility

Accessibility in Forgejo needs a lot of work and it was difficult to figure out where to start. The accessibility team works in multiple issue trackers (meta, forgejo, user research, etc). The discussions started in a dedicated Matrix room, which turned out to not be very accessible, so a Fediverse hashtag #ForgejoAccessibility was created as an alternative to experiment with.

Despite the shortcomings of the current Forgejo UI framework, concrete changes were made to the codebase to get things moving. The challenge is to guard them against regressions because there are no automated tests. Since the community impacted is small, the chance that accessibility improvements are broken is high.

Federation

Federation development has been progressing slowly. Most of the time was spent on refactoring the current code, working on the ForgeFed vocabulary and the F3 schemas.

Forgejo CI

Since it started out on Woodpecker instances provided by individuals due to performance issues with the database integration tests on Codeberg-CI, the work on centralizing / unifying the CI has been ongoing. Codeberg solved part of the problem by dedicating hardware resources to Forgejo: using a RAM disk to workaround the slow HDD performances, it runs fast without thrashing short-lived SSDs, reducing ecologically problematic ewaste. The Forgejo devOps team weren't used to working with LXC containers (which is what Codeberg is built upon), so there was (and still is) a learning curve to work on.

To allow for better safeguarding of the CI against malicious PRs and to better protect the secrets (signing keys, upload credentials) used to actually release Forgejo, forgejo-ci.codeberg.org has no secrets at all. This was also necessary due to some hardware limitations: there is not enough disk space to build a Forgejo release. Another Woodpecker CI instance is used instead and its access is restricted to better protect the release signing keys.

End-to-end testing

The key to a robust release process is the ability to run tests verifying that it works as expected. Not just unit tests that are routinely run by the Forgejo CI or integration tests included in the codebase. End-to-end tests deploy the release itself and are required to run scenarios that resemble what users would do. The alternative is to ask human beings to run these tests manually, but it is error prone and gets boring very quickly.

The Forgejo release is published in the Forgejo experimental organization and then used to run tests that do something along these lines:

Deploy Woodpecker
Deploy Forgejo
Create a user and repository in Forgejo
Submit a job to Woodpecker by pushing to the repository
Verify the outcome of the job is as expected

Because Forgejo is small, it takes around two minutes for this test to complete. It is now run against every release, and while verification by human beings is still needed, they can focus on what matters instead of trivial mistakes.

Contributions to Woodpecker

Running end-to-end tests is technically challenging, there's a reason it is still not common practice. Although it would be possible to use Docker, it's a stretch (see this example). The ideal situation is when the test can begin on a freshly provisioned operating system that will be disposed of when the test completes, cleaning up all the left overs even in the event of a catastrophic failure.

An LXC backend was developed for Woodpecker to provide such an environment. Woodpecker container images are published for internal use by Forgejo, but are not supported.

It is common practice to use a patched version of some software while waiting for pull requests to be accepted. The risk is to forget to do the work to get the changes accepted upstream, accumulating the associated technical debt. The patched version of Woodpecker is published in a dedicated repository as a reminder and each commit is labelled with the corresponding upstream pull request.

Forgejo contrib

Over the past few months, people who rely on Forgejo came to expect a certain quality of work as well as long term maintenance. When someone has a great idea and lots of energy, they may not be willing to match those expectations right away. Sharing a clever hack, bootstrapping documentation, creating a list of resources related to Forgejo and temporarily distributing Woodpecker container images are but a few examples.

The Forgejo contrib organization was created as a space where projects related to Forgejo can exist without being subject to high expectations. It is fine to create a repository that will be abandoned a few weeks later. It is fine to engage in a project that is not agreed upon by other Forgejo community members. The only requirement (and it's a serious one) is to behave in a way that does not go against the Code of Conduct.

A curated list of delightful Forgejo-related projects and resources was created there and quickly became a useful reference. If you're working on a Forgejo-related project, feel free to submit it for inclusion on the list.

Well-Being & Code of Conduct

Forgejo created a Well-Being team and adopted a Code of Conduct from day one because tensions are bound to happen in such an inclusive environment. And with over three hundred people in the chat room, it happened a few times in the past weeks. When someone uses coarse language and engages in a heated discussion, it has a chilling effect and silently drives people away. To help prevent that, the Well-Being team does its best to intervene in a gentle way before it escalates to a point where the Code of Conduct would have to be enforced. There were only two instances where a reminder of the Code of Conduct had to be mentioned: there is zero tolerance for calling another community member names or making derogatory comments towards an ethnic community.

Obviously it would be better if no such comments had been made at all, but it is hoped that the actions taken will alleviate any fears that any intolerance would be permitted. Hopefully any affected individuals will be encouraged to continue to participate in discussions as endeavors are made to ensure this is a safe space for all community members.

Governance

Decision process

As expected, the process to define the governance is taking its time. The need for a decision-making progress emerged during the last two meetings on 23 December and 27 January (part 1 and part 2) and was partially formalized. The general idea is that a decision leads to an agreement that is documented so that Forgejo community members can conveniently refer to it when needed. The list of agreements has just one item at the moment related to branding (name, logo, etc).

The first decisions

Meanwhile, this ongoing governance work inspired community members to move forward, and a few discussions that may lead to decisions are ongoing. Topics include very concrete aspects of development such as the criteria in order to define how a PR should be approved which was followed by a pull request to document the agreement. Additionally, there are very high level and much longer discussions such as licensing Forgejo under copyleft. It's still blurry but something is emerging. It boils down to:

Discussing
Proposing an agreement
Documenting the agreement

Agreements for team members

As time passes, the need to replace the teams that have been in place since Forgejo started becomes more pressing. For instance, given how critical their work is, members of the security team must be agreed upon by the community. It was suggested during the last governance meeting that the procedure goes as follows:

Discussion: people willing to participate in the security team send a formal and public application (see this application for the release team for an example)
Proposing an agreement: if the discussion about the applicant seems to meet the approval of the Forgejo community, a pull request to modify the security team is proposed
Documenting the agreement: if the pull request is approved, it is merged and the agreement is published in the meta repository.

We Forge

Forgejo is a community of people who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please ask for an update.

A minority of Forgejo contributors earn a living by implementing the roadmap co-created by the Forgejo community, see the sustainability repository for the details.

Forgejo Security Release 1.18.2-1

Mon, 23 Jan 2023 00:00:00 GMT

Today Forgejo v1.18.2-1 was released.

This stable release includes a security fix. It was possible to reveal a user's email address, which is problematic because users can choose to hide their email address from everyone. This was possible because the notification email for a repository transfer request to an organization included every user's email address in the owner team. This has been fixed by sending individual emails instead and the code was refactored to prevent it from happening again.

Recommended Action

We strongly recommend that all installations are upgraded to the latest version as soon as possible.

Forgejo installation instructions

See the download page for instructions for installation instructions. If you are upgrading from Forgejo 1.18.X-N (or Gitea 1.18) no manual action is required. If you're on Gitea v1.17.X or older please read the release notes carefully, and in particular check out the breaking changes section of Gitea's blog post.

Codeberg is not vulnerable

The Forgejo security team is a joint effort with Codeberg which already runs a Forgejo version that includes the security fix.

Responsible disclosure to Gitea

On 21 January 2023, as soon as the Forgejo security team confirmed the vulnerability, the detailed conclusions were communicated to the Gitea security team. The corresponding bug fix was published 22 January 2023.

Contribute to Forgejo

Forgejo Critical Security Release 1.18.1-0

Wed, 18 Jan 2023 00:00:00 GMT

Today Forgejo v1.18.1-0 was released.

This release contains an important security fix for Forgejo container images, as described below. When Forgejo runs from a binary, recommendations to upgrade the git version installed alongside it are also provided.

This release also contains branding improvements (webhooks, headers, etc.) and includes a more robust release process, as detailed in the release notes.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When using a Forgejo binary: upgrade the git package to a version greater or equal to v2.39.1, v2.38.3, v2.37.5, v2.36.4, v2.35.6, v2.34.6, v2.33.6, v2.32.5, v2.31.6, or v2.30.7
When using a Forgejo container image: docker pull codeberg.org/forgejo/forgejo:1.18.1-0

Critical security issues in Git

Git recently announced new versions to address two CVEs (CVE-2022-23521, CVE-2022-41903). On 17 January 2023, Git published the maintenance release v2.39.1, together with releases for older maintenance tracks v2.38.3, v2.37.5, v2.36.4, v2.35.6, v2.34.6, v2.33.6, v2.32.5, v2.31.6, and v2.30.7. All major GNU/Linux distributions also provide updated packages via their security update channels.

The Forgejo security team analyzed both CVE and confirmed that Forgejo can be used as an intermediary by an attacker to reach a vulnerable git version. The Forgejo codebase itself is not at fault and has no way to mitigate the problem: the only solution is to upgrade the git binary.

Fixing Git when using a Forgejo binary

When installed as a binary downloaded from the Forjego releases repository, it is the responsibility of the Forgejo admin to install git independently. Upgrading to a patched git package (with a version greater or equal to v2.39.1, v2.38.3, v2.37.5, v2.36.4, v2.35.6, v2.34.6, v2.33.6, v2.32.5, v2.31.6, and v2.30.7) is therefore enough to fix the problem, even if Forgejo is not upgraded. Note that some distributions (such as Ubuntu) may backport security fixes to older git versions instead of upgrading, and it is worth looking at the changelog for confirmation. If a package is older than 17 January 2023, it will NOT contain the security fix because it was only made public on that date.

Fixing Git when using a Forgejo container image

$ docker run --rm codeberg.org/forgejo/forgejo:1.18.0-1 git --version
git version 2.36.3

The Forgejo 1.18.1-0 images were built shortly after the patched git binary was upgraded in Alpine 3.16 and is not vulnerable:

$ docker run --rm codeberg.org/forgejo/forgejo:1.18.1-0 git --version
git version 2.36.4

In this case it is necessary to upgrade Forgejo to 1.18.1-0 to get the fixed git binary. The rootless variant of Forgejo also includes the git binary and can be upgraded in the same way.

Forgejo installation instructions

See the download page for instructions for installation instructions. If you are upgrading from Forgejo 1.18.0-1 (or Gitea 1.18) no manual action is required. If you're on Gitea v1.17.x or older please read the release notes carefully, and in particular check out the breaking changes section of Gitea's blog post.

Codeberg is not vulnerable

The Forgejo security team is a joint effort with Codeberg which already runs a git version that is not vulnerable.

Responsible disclosure to Gitea

As soon as the Forgejo security team confirmed the vulnerability, the conclusions were communicated to the Gitea security team. Forgejo recommended a rebuild of the Gitea container images for 1.18.1, that were created shortly before the proper Alpine package version was available.

Contribute to Forgejo

Answering Forgejo federation questions

Tue, 10 Jan 2023 00:00:00 GMT

What is federation?

Federation is about creating open protocols so that different servers can communicate with each other. Once Forgejo gains federation support via the ForgeFed protocol, you'll be able to do things like create issues for projects on other Forgejo instances without creating an account on that instance. But federation doesn't just solve the problem of having to create many Forgejo accounts. The power of federation comes from building an interoperable ecosystem, since any other code collaboration site or development tool can also add ForgeFed support. Just look at GitHub: it's the epicenter of a giant ecosystem of apps and integrations and tools that cements GitHub's position. It's a textbook example of a walled garden. We want to create something similar, but in an open ecosystem where everything speaks the ForgeFed protocol, so you're never locked-in by which forge or code collaboration software that you use.

Is Forgejo federation development being worked on right now?

Yes. You can find an up-to-date task list here.

When will federation be released?

Forgejo federation will be merged into mainline Forgejo through two (or more) pull requests. The first pull request, which will be submitted later this month, includes backend support for some basic federation features like following remote users, opening issues on remote repositories, and blocking instances. A second pull request will include a UI for federation, more moderation features, and backend support for federating all of Forgejo's features, such as adding remote users as repository collaborators. Federation will most likely be included in Forgejo 1.19, which will be released in a few months.

Will Gitea also gain federation?

Most likely yes. We want as many forges as possible to be federated, so we will contribute the federation code upstream to Gitea.

What's F3 and how does it relate to federation?

A lot of difficult and seemingly unrelated problems like migrating projects, federated pull requests, and mirroring issues actually have the same solution. A project's code is stored using Git and can be easily migrated, but the issues, pull requests, and project metadata are stored in the database. If only we had a common format for representing all the various components of a project and code to serve and store project components using this format... then mirroring issues would be as easy as fetching remote issues in this format and storing them on our instance. I know, let's make our own format!

And that's why F3 was created. It's a JSON format closely based on how projects are internally stored in Forgejo's database. Although it has a similar semantics, it is different from the ForgeFed vocabulary. Since the rest of Forgejo federation uses ForgeFed, we're working on unifying F3 and the ForgeFed vocabulary so they can use the same codebase.

Forgejo v1.18 stable is released

Thu, 29 Dec 2022 00:00:00 GMT

Today Forgejo v1.18.0-1 was released. This is the first stable release of Forgejo, and is based on Gitea v1.18.0 which was also released today.

Get Forgejo v1.18

See the download page for instructions on how to install Forgejo, and read the release notes for more information on what's new.

Upgrading from Gitea

This is the moment you have been waiting for. This stable release offers an upgrade and a transition path from Gitea to Forgejo. If you're on v1.17.x or older please read the release notes carefully, and in particular check out the breaking changes section of Gitea's blog post.

Contribute to Forgejo

First forgejo monthly report - December 2022

Mon, 26 Dec 2022 00:00:00 GMT

Forgejo was announced in December 2022 and this report explains how it happened. It is the creation of a collective of people from diverse backgrounds united towards a common goal: enabling Free Software contributors with Free Software tools. The software forge it provides can be downloaded and used right away and it has a unique non-technical feature: the community that drives its roadmap can be trusted to put the interest of the general public first. Forging Free Software is not just about writing code, it is a social construct that involves everyone in a continuous loop.

This first monthly report is meant to provide a high-level update of what happened in Forgejo, for people who want to follow its progress from a distance. Fact checking is made easy with links to the issue trackers or chat rooms where the action happened: everything in Forgejo since its inception has been 100% transparent. Video conferences are also organized monthly for Forgejo community members to ask questions.

Bootstrap

After Gitea Ltd confirmed the takeover of the Gitea project on 30 October 2022, a group of people proposed that Codeberg e.V. should become the custodian of a fork of Gitea. The proposal was accepted 16 November 2022:

Codeberg e.V. is in control of the domains and the trademarks (if any)
Forgejo contributors are a self-governed group of people (a "gremium" in the Codeberg e.V. parlance)
The Codeberg e.V. general assembly reviews if Forgejo is aligned with its mission on a yearly basis, based on the monthly reports Forgejo publishes

The essential conditions for a fork to succeed were met and Forgejo was able to be bootstrapped in a sustainable way:

A well-known and trusted organization agreed to support and use Forgejo
A group of people with the right skills and stamina committed to provide a long-term effort
The strategy to create a soft fork was a good match for the Forgejo contributors workforce

It took another month for the bootstrap to complete and Forgejo was announced 15 December 2022.

Development and Distribution

From a technical point of view, Forgejo is a drop-in replacement for Gitea: it can be used without any modification by simply replacing the Gitea binary (or container image).

The first technical work that was done was to replace the Drone (which is not Free Software) release pipeline used by Gitea with a pipeline based on Woodpecker CI. It produced a release candidate for Forgejo 1.18.0-rc1-1 and is ready for the 1.18 release that will include:

binaries for GNU/Linux amd64, arm64 and armv6 (which can also be used on armv7)
container images for amd64 and arm64, either running as root or rootless

It will include some Forgejo branding changes and default settings to enhance privacy. And more importantly, it provides a non-technical feature: trust in a sustainable non-profit community to further the interest of the general public.

The forge federation features is a focus of Forgejo. Although it is not ready to be released with version 1.18, active development started to support ActivityPub and F3.

User Centric Roadmap

Already within a few days dozens of ideas for improving Forgejo were submitted. They express the needs and preferences of Free Software contributors with regards to how they forge their software. This raw material is input to the roadmap and will lead Forgejo on a path that is unique and different than what corporate forges like Github and Gitlab have to offer. Forgejo will place the community firmly in control of project direction.

How can Forgejo go from an unsorted pile of ideas to an exciting roadmap? What innovations will inspire contributors? And how do these ideas transform into concrete features that will be implemented, instead of lingering as open issues on the backlog? To address people's needs and be most beneficial for the commons and public interest, Forgejo will follow a structured method of User Research, align with Social Coding Movement, and contribute back insights about Free Software development to evolve the movement's best-practices.

A repository was created to bootstrap that effort. It requires a kind of skill that is rare but Forgejo is in a lucky position and benefits from mentoring and past examples related to forge federation. Some Forgejo contributors also intend to participate in the OSD devroom early 2023 during FOSDEM.

The Forgejo accessibility team was created and just began User Research to figure out what matters most to people who struggle with Forgejo because of its accessibility shortcomings.

Governance

The Forgejo domains are owned by Codeberg e.V.. Forgejo is therefore ultimately under the control of Codeberg e.V. and its governance. However, although Codeberg e.V. is committed to use and host Forgejo, it is expected that Forgejo defines its own governance.

The process to define the governance is in progress and expected to take weeks if not months. The first two meetings happened (24 November and 10 December). Discussions followed to define how decisions are proposed and enacted.

While the governance is being defined, there was a need to establish an interim Forgejo governance for safeguarding credentials, enforcing the Code of Conduct and ensuring security vulnerabilities are handled responsibly for the Forgejo releases. All people with a role in the interim Forgejo governance pledge to resign as soon as the Forgejo governance is in place. The people and teams that are part of the interim governance are listed publicly.

Branding

The support for theming in Gitea is brittle and rebranding is a challenge.

The easy part was the choice of the Forgejo name, which started 6 November and took ten days, with multiple rounds of discussion. The forgejo.org domain was then acquired and Codeberg e.V. has control over the registrar account. A logo was then created as well as a mascot.

The more substantial work then started in a dedicated branch. The rebranding touches many areas and needs to be done in such a way that it is transparent for people upgrading from Gitea. It involves filenames, environment variables, configuration settings, web templates, ... Not only is it tedious, it is also subject to conflicts when rebasing on top of Gitea.

Localization

The Gitea codebase is internationalized in a way that follows the expected standards. But the localization (i.e. the translations in various languages) relies on a proprietary service that has the translation community locked in. Since Forgejo is committed to exclusively use Free Software dependencies and services, it has to use an alternative.

Fortunately, Weblate is a quality self-hostable translation platform and an instance is provided by Codeberg. Initial work started in a dedicated branch, for the technical part.

The most difficult part will be to bootstrap a community of translator working on Weblate instead of the proprietary platform that Gitea depends on. Ideas on how to achieve that in an incremental way are most welcome.

Communication and Code of Conduct

As a new project Forgejo had to create new communication channels:

a static website at https://forgejo.org built by a CI pipeline from a repository for collaborative editing.
a social account at https://floss.social/@forgejo where content is either published after a consensus is reached from the Forgejo community or signed by the author trusted with access to the account.
a Matrix space where the main room welcomes Forgejo users to answer any question they may have and development rooms where technical discussions happen between people actively working.
all other communications happen on the forge itself, in a spirit of dogfooding. For instance, although it may be more convenient to use a forum such as Discourse for informal discussions or a task manager to organize the work, the issue tracker is used instead.

All communication happens in public, transparently, so a newcomer can immediately get up to speed by reading the backlog. A Code of Conduct was adopted very early on and applies to all spaces under the responsibility of the Forgejo community. It is essential to create an inclusive environment where everyone can feel safe and a Well Being team is here to help if needed.

A particular effort was made when drafting the Forgejo announcement and the Codeberg blog post to explain that Forgejo is meant to reunite the community. It does not compete with Gitea, it builds upon it.

Sustainability

The ideal Free Software project is sustainable because it involves many independent individuals who have the means to work for the interest of the general public, in the long run. It is unhealthy when it relies heavily on overworked volunteers who eventually burn out. It is also unhealthy when it is exclusively under the control of a single for-profit organization that works for the benefit of its shareholders.

Forgejo is set to create a healthy balance that involves:

A majority of independent volunteers who are in control of Forgejo via a governance that empowers them. They are representatives of the general public and ultimately the only ones who legitimate to make decisions.
A minority of people who earn a living by implementing a roadmap co-created by the Forgejo community.

As of today there are just a handful of people paid for their work and an order of magnitude more who volunteer. A grant application was submitted December 1st while another is ongoing and already funds some of the work towards forge federation.

It is unclear if Forgejo will manage to be sustainable while so many other Free Software projects struggle. But maybe it will because it does something unique: being transparent about its funding. Not translucent: transparent.

Beyond coding. We forge.

Thu, 15 Dec 2022 00:00:00 GMT

After many days of hard work and preparation by a team of former Gitea maintainers and enthusiasts from the FOSS community, we are proud to announce that the Forgejo project is now live.

Forgejo (/forˈd͡ʒe.jo/ – inspired by forĝejo, the Esperanto word for forge) is a community-driven Free Software project that develops a code forge platform similar to GitHub, and that is a drop-in replacement for Gitea. We started Forgejo in reaction to control of Gitea being taken away from the community by the newly-formed for-profit company Gitea Ltd without prior community consultation, and after an Open Letter to the Gitea project owners remained unanswered. The Forgejo project has two major objectives that drive our development and road map:

The community is in control, and ensures we develop to address community needs.
We will help liberate software development from the shackles of proprietary tools.

We are people in control of our future

The first objective relates to how we are organized as a project. It is crucial for Forgejo to guarantee that our product will remain Free Software forever, under the guidance of an open and inclusive community. Forgejo will provide a healthy project governance, so that it can truly focus on the needs of all those people that use our software on a daily basis.

To this end we are very proud that Codeberg e.V. has decided to become our project’s custodian. Codeberg e.V. is a non-profit organization with a stellar reputation, that is dedicated to the success of the Free Software movement. They provide software development services to FOSS projects at Codeberg.org. They are rapidly growing and hosting more than 50,000 code repositories for about 40,000 people. Not only will Codeberg take care of the Forgejo domain names and trademarks, but the organization will use Forgejo as the basis for their own services, instead of Gitea.

Forgejo's code base is of course hosted on Codeberg, and by using Woodpecker CI instead of Drone and Matrix instead of Discord, we exclusively rely on Free Software tools.

We will help liberate software development

Our second objective relates to the product that we deliver. Free Software projects are in general heavily focused on coding. But development of quality software also involves work in many other areas. For the long-term sustainability of any Free Software, project many aspects must be taken into account. Successful software products involve collaboration between many people with different skill sets.

Forgejo's vision is to make software development accessible to everyone – bringing true inclusion and diversity to a field traditionally dominated by technical-skilled people, and where many of the tools used are proprietary services with companies dictating who has access, and who does not.

Our vision offers our community a very exciting path forward. For our development road map we will consider the entirety of the Free Software Development Lifecycle (FSDL) and gradually unlock it to the world. We intend to be part of a growing ecosystem of collaborating Free Software projects that dedicate to this same vision. We see forge federation as a means to open up the development process, and it is here that we will innovate.

Join our adventure

Help make coding social. Join us in our quest, be part of our adventure. Forgejo is not just a code forge. We go beyond coding. Together we forge Free Software!

Stay tuned to our blog. The coming period we will provide you with many updates about our project organization.

Forgejo News

Forgejo monthly report - January 2026

Releases

Forgejo v14

Security releases: Forgejo v11 and v13

Forgejo runner v12

LXC Logging Enhancements

Forgejo Helm chart v16 and v15

Discussions

Mentions of all users in the main chat room

License and copyright attributions in Forgejo's codebase

Improving issue to implementation workflow

Notable Pull Requests

Actions: Reusable workflow expansion

Forgejo Runner: Unsupported Platforms

Auto-linking container images to repositories

Generate merge commit message in non-mergeable PRs

Federation

Localization

Infrastructure

Website moved to own infrastructure

Renovate for website and docs

Database of code.forgejo.org grew unexpectedly fast

Full disk on CI server

Release automation improved

HTML and JSON compression

Moderation

Other

FOSDEM

Matrix security disclosure

We forge

Forgejo v14.0 is available

Summary

UI features

Search syntax support for Issues and PRs

New file editor

Switch between formats when previewing CITATION.{cff,bib} files

Interact with UI without JavaScript

Improvements to Forgejo actions

Pull Request Trust Management

Commit Status Cleanup

"Waiting" status Display

Concurrency Groups

Dynamic Matrices & Runs-On

Security features

Validation of the authorized_keys file

Stateless CSRF protection

Database improvements

Goodbye "Pull requests -1" caused by DB Deadlocks

Database foreign keys

Distributed database queries

Release schedule and Long Term Support

14.0-test daily releases

Get Forgejo v14.0

Upgrading

Contribute to Forgejo

Donate

Forgejo monthly report - November 2025

Releases

Forgejo v13.0.3

Forgejo runner v12

Forgejo Helm chart v15.0.3

Accessibility

User research

Federation

Infrastructure

Other

Dutch government shows interest in Forgejo

Matrix security disclosure

We Forge

Forgejo monthly report - October 2025

Releases

Forgejo v13

Helm chart

Forgejo is 3 years old

Contrib Projects

User research

Federation

Sustainability

Infrastructure

Validation of the `authorized_keys` file

Logger mode settings `LOGGER_<NAME>_MODE`