runbot/runbot_merge/controllers
Xavier Morel 69f5cac2d7 [FIX] runbot_merge: support non-ascii secrets & sha256 signatures
Per the Github webhook documentation:

1. sha1 signatures are deprecated, github recommends sha256 (though
   that's unlikely to be a concern anyway), and dummy-central supports
   both so it should be no issue.

   > If possible, we recommend that you use the x-hub-signature-256
   > header for improved security.

2. Non-ascii secrets are supported and should be utf8-encoded to
   compute signatures... that's not actually documented as github docs
   only mention payload encoding but it seems to make sense anyway.

Also improve the warning message by replacing the signature (which is
useless) by the delivery id (which could allow introspecing the hook
or something).
2023-08-30 11:43:13 +02:00
..
__init__.py [FIX] runbot_merge: support non-ascii secrets & sha256 signatures 2023-08-30 11:43:13 +02:00
dashboard.py [IMP] runbot_merge: filtering options and UX on stagings list 2023-07-10 15:23:31 +02:00
reviewer_provisioning.py [FIX] runbot_merge: make provisioning more resilient 2023-06-21 14:26:19 +02:00