Conversation
Uzlopak
changed the title
|
Implemented now in a way, that it does not break. EDIT: |
wolfy1339
added
Type: Breaking change
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const signatureMatches = await verify("foo", eventPayload, signatureSHA256); | ||
| test("verify(secret, eventPayload, signature) returns false for incorrect secret", async () => { | ||
| const signatureMatches = await verify("foo", eventPayload, signature); | ||
| expect(signatureMatches).toBe(false); |
Check failure
Code scanning / CodeQL
Hard-coded credentials
gr2m
left a comment
gr2m
left a comment
There was a problem hiding this comment.
this is a breaking change as we change the API by removing the algorithm argument. But we can absorb the breaking change in @octokit/webhooks as GitHub no longer supports sha1 in any of its maintained GHES versions.
Can you please update the README?
|
@gr2m |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
gr2m
changed the title
signSync, verifySync
gr2m
left a comment
gr2m
left a comment
There was a problem hiding this comment.
actually, can you document signSync and verifySync?
I'm not 100% sure if we really need it, I don't like the fact that available methods diverge between the JS runtimes.
Maybe let's leave out the introduction of signSync and verifySync and discuss that in a separate PR?
3 participants
We anyway just check if sha256 is given.
Add the signSync and verifySync methods, as crypto code runs in C++ code of node, which makes it by nature block the event loop of node. By making it sync we reduce the unecessary overhead of creating intermediary Promises, which are thrown away anyway. So we can use that in probot / webhooks.js.
Only when using web crypto async maybe makes sense, because that runs by nature async, but I suspect to be signifcantly slower.
We need to patch then webhooks.js repo to use sync calls.
@semver-minor.
Resolves #ISSUE_NUMBER
Before the change?
After the change?
Pull request checklist
Does this introduce a breaking change?
Please see our docs on breaking changes to help!