tsharps/TSHARPS-CI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: tsharps:TestDevelop
Branches Tags
tsharps:TestProduction
tsharps:TestDevelop
tsharps:TestStaging
..
compare: tsharps:TestProduction
Branches Tags
tsharps:TestDevelop
tsharps:TestProduction
tsharps:TestStaging

No commits in common. "TestDevelop" and "TestProduction" have entirely different histories.
TestDevelo ... TestProduc

1 changed files with 2 additions and 8 deletions
Show Stats Expand all files Collapse all files

10
ci-webhook.py
View File

@ -29,17 +29,11 @@ SECRET = CONFIG.get("webhook_secret", "").encode()
def verify_signature(payload: bytes, signature: str) -> bool: def verify_signature(payload: bytes, signature: str) -> bool:
"""Verify Gitea webhook HMAC signature. """Verify Gitea webhook HMAC signature."""
Gitea sends X-Gitea-Signature as a bare hex digest. GitHub-style senders
prefix it with "sha256=". Accept either form — the HMAC comparison itself
is unchanged, so this does not loosen verification.
"""
if not SECRET: if not SECRET:
return True # No secret configured — accept all return True # No secret configured — accept all
expected = hmac.new(SECRET, payload, hashlib.sha256).hexdigest() expected = hmac.new(SECRET, payload, hashlib.sha256).hexdigest()
provided = signature[len("sha256="):] if signature.startswith("sha256=") else signature return hmac.compare_digest(f"sha256={expected}", signature)
return hmac.compare_digest(expected, provided)
class WebhookHandler(BaseHTTPRequestHandler): class WebhookHandler(BaseHTTPRequestHandler):