forgejo/public/.well-known/security.txt

# This site is running a Forgejo instance.
# Forgejo-related security problems should be reported to the Forgejo security team.
# Site-related security problems should be reported to this site's admin.
Contact: mailto:security@forgejo.org
Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/1B638BDF10969D627926B8D9F585D0F99E1FB56F
Preferred-Languages: en
[BRANDING] Brand security.txt - The [security.txt](https://securitytxt.org/) is a standardized file to help with reporting security vulnerabilities, by having the most essential information served at `.well-known/security.txt`. - Brand this file to point to the Forgejo security team. - Resolves https://codeberg.org/forgejo/forgejo/issues/1192 2023-08-05 19:58:30 +00:00			`# This site is running a Forgejo instance.`
			`# Forgejo-related security problems should be reported to the Forgejo security team.`
			`# Site-related security problems should be reported to this site's admin.`
			`Contact: mailto:security@forgejo.org`
			`Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/1B638BDF10969D627926B8D9F585D0F99E1FB56F`
Serve pre-defined files in "public", add "security.txt", add CORS header for ".well-known" (#25974) Replace #25892 Close #21942 Close #25464 Major changes: 1. Serve "robots.txt" and ".well-known/security.txt" in the "public" custom path * All files in "public/.well-known" can be served, just like "public/assets" 3. Add a test for ".well-known/security.txt" 4. Simplify the "FileHandlerFunc" logic, now the paths are consistent so the code can be simpler 5. Add CORS header for ".well-known" endpoints 6. Add logs to tell users they should move some of their legacy custom public files ``` 2023/07/19 13:00:37 cmd/web.go:178:serveInstalled() [E] Found legacy public asset "img" in CustomPath. Please move it to /work/gitea/custom/public/assets/img 2023/07/19 13:00:37 cmd/web.go:182:serveInstalled() [E] Found legacy public asset "robots.txt" in CustomPath. Please move it to /work/gitea/custom/public/robots.txt ``` This PR is not breaking. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io> 2023-07-21 12:14:20 +00:00			`Preferred-Languages: en`