Validate github webhooks

[ekohl]

https://developer.github.com/webhooks/securing/ has some examples on how to verify the payload came from Github. It's likely other payloads needs a similar verification.

[alexjfisher]

This is already done, but probably wants moving? https://github.com/voxpupuli/puppet-webhook/blob/master/lib/puppet_webhook.rb#L44

[ekohl]

Totally missed that. There's a difference:

https://github.com/voxpupuli/puppet-webhook/blob/94fd5bbba0be6bf85be240e4dbaa77b0c59ef8f9/lib/puppet_webhook.rb#L44

https://github.com/voxpupuli/puppet-webhook/blob/94fd5bbba0be6bf85be240e4dbaa77b0c59ef8f9/lib/puppet_webhook.rb#L86

I can't find the definition of verify_signature?.

[alexjfisher]

It's hiding away in tasks.rb...
https://github.com/voxpupuli/puppet-webhook/blob/94fd5bbba0be6bf85be240e4dbaa77b0c59ef8f9/lib/helpers/tasks.rb#L150

[dhollinger]

I'm going to go ahead and close this issue.