-
Notifications
You must be signed in to change notification settings - Fork 63k
Add python example for signature validation on secret scanning notifications #18776
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Actually, there are two different ways to validate the signature; one uses Cryptodome (https://pycryptodome.readthedocs.io/en/latest/) and the other uses python-ecdsa (https://github.com/tlsfuzzer/python-ecdsa)
Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines. |
Automatically generated comment ℹ️This comment is automatically generated and will be overwritten every time changes are committed to this branch. The table contains an overview of files in the Content directory changesYou may find it useful to copy this table into the pull request summary. There you can edit it to share links to important articles or changes and to give a high-level overview of how the changes in your pull request support the overall goals of the pull request.
fpt: Free, Pro, Team |
@ckuethe Thanks so much for opening a PR! I'll get this triaged for review ✨ |
Thanks for opening a pull request! We've triaged this issue for technical review by a subject matter expert 👀 |
This is a gentle bump for the docs team that this PR is waiting for technical review. |
This is a gentle bump for the docs team that this PR is waiting for technical review. |
This comment was marked as resolved.
This comment was marked as resolved.
Hello @janiceilene, @felicitymay, and @cmwilson21 - do you know if the appropriate folks have had a chance to look at this issue? |
@ckuethe Thanks for checking in! The PR is on our board waiting for review. A writer will get eyes on it soon. 👀 Thank you for your patience as we work through our backlog 💛 |
Hi @ckuethe - thanks for your patience 🙏🏻 We've checked with the relevant team and we are happy to accept your contribution ✨ However, could you remove the caching of our public key, and provide one example only? In the long term, we ideally want to link to an examples repository, which would be easier for everyone to maintain. In the mean time, we understand that examples are helpful to our users, but we don't want to have too many of these (maintainability issue). Thanks in advance for your understanding. I am happy to review your PR once you've made these changes 😃 |
Hello @mchammer01 - Updated to address your feedback. Let me know if there are other changes you'd like. |
Thank you @ckuethe - I've asked one of the team for a final technical review. Thanks for your patience 🙂 🙏🏻 |
@marzvrover - would you mind reviewing this from a technical perspective? (As a member of the Docs team, I did an editorial review, and this LGTM). Thanks in advance for your help with this 🙇🏻 😃 |
Assuming you have python-ecdsa installed, you should be able to simply paste the example into a python 3 interpreter. I'm a fan of examples that have cut-paste-and-do-what-i-mean functionality :) |
Hello @mchammer01 @marzvrover - anything else you would like me to update in this example? I just updated the comment to accurately reflect that this PR now contains only a single implementation of validation using |
@marzvrover - gentle bump on the request above 💜 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, and thanks for your patience with us @ckuethe 💖
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @ckuethe sorry for the delayed response.
Could you please remove the hardcoded public key? Your previous implementation for fetching the public key from api.github.com/meta
works :)
Thanks
@marzvrover Can I push back on that request? I'd like this example to be completely standalone. For the purposes of this demonstration it's not important exactly how the key gets into memory, it's not important how the message to be validated to gets into memory. What is important is that we have a message, a public key, and a simple example of using that key to determine message validity. Fetching the key from the API would require additional logic to handle signing key changes by checking the key ID, and |
@ckuethe it helps enforce the best practice of pulling in our active keys rather than relying on a local copy. This would keep the Python sample inline with our Go, Ruby, and JavaScript samples. |
@ckuethe - can you follow @marzvrover's recommendation above for consistency? |
👋 Just checking in. It looks like it's been a while since anything was updated on this one. I'm going to go ahead and close it now, but feel free to ping me or reopen if you'd like to resume work on it. 💛 |
Adding @ckuethe as a Co-Author of this commit because Chris provided these python implementations in github/docs#18776. Co-authored-by: Chris Kuethe <ckuethe@users.noreply.github.com>
Hi @ckuethe, I just wanted to let you know that we used your contributions and added you as coauthor for the commit github-technology-partners/signature-verification@85ca4c5. |
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Sheena Ganju <sheenyg@github.com> Co-authored-by: Sophie <29382425+sophietheking@users.noreply.github.com>
Why:
The secret scanning workflow documentation (https://docs.github.com/en/enterprise-cloud@latest/developers/overview/secret-scanning-partner-program#implement-signature-verification-in-your-secret-alert-service) doesn't have example validation in python. I found at least two other people asking about how to do this in python with no answers.
Fixes #18778
What's being changed:
Added an example of signature validation using python-ecdsa (https://github.com/tlsfuzzer/python-ecdsa)
Check off the following:
Writer impact (This section is for GitHub staff members only):