mantisbt-plugins / source-integration

Source control integration plugin framework for MantisBT, including support for Github, Gitlab, Bitbucket, Gitea, Gitweb, Cgit, Subversion, Mercurial and more
http://noswap.com/projects/source-integration/
MIT License
181 stars 130 forks source link

GitHub: use X-Hub-Signature-Sha-256 header to validate webhook payloads #361

Closed dregad closed 3 years ago

dregad commented 3 years ago

In late 2020, GitHub introduced a new X-Hub-Signature-Sha-256 header to sign Webhook payloads with the more secure sha256 hash.

The legacy, sha1-based X-Hub-Signature header we're currently using is still around for backwards compatibility, but we should update the precommit() method to use the new one.