Skip to content

Commit 592935e

Browse files
OctomergerOctomerger
authored
Merge pull request github#21247 from github/repo-sync
repo sync
2 parents 15f6c10 + 0d6e19d commit 592935e

File tree

2 files changed

+62
-38
lines changed

2 files changed

+62
-38
lines changed

‎components/guides/ProductGuides.tsx

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -17,26 +17,28 @@ export const ProductGuides = () => {
1717
<GuidesHero />
1818
</LandingSection>
1919

20-
{learningTracks && learningTracks.length > 0 && (
21-
<LandingSection
22-
title={`${title} learning paths`}
23-
className="border-top py-6"
24-
sectionLink="learning-paths"
25-
description={t('learning_paths_desc')}
26-
>
27-
<LearningTracks />
28-
</LandingSection>
29-
)}
20+
<div data-search="article-body">
21+
{learningTracks && learningTracks.length > 0 && (
22+
<LandingSection
23+
title={`${title} learning paths`}
24+
className="border-top py-6"
25+
sectionLink="learning-paths"
26+
description={t('learning_paths_desc')}
27+
>
28+
<LearningTracks />
29+
</LandingSection>
30+
)}
3031

31-
{includeGuides && (
32-
<LandingSection
33-
title={`All ${title} guides`}
34-
className="border-top py-6 color-border-default"
35-
sectionLink="all-guides"
36-
>
37-
<ArticleCards />
38-
</LandingSection>
39-
)}
32+
{includeGuides && (
33+
<LandingSection
34+
title={`All ${title} guides`}
35+
className="border-top py-6 color-border-default"
36+
sectionLink="all-guides"
37+
>
38+
<ArticleCards />
39+
</LandingSection>
40+
)}
41+
</div>
4042
</DefaultLayout>
4143
)
4244
}

‎content/developers/overview/secret-scanning-partner-program.md

Lines changed: 41 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -59,26 +59,25 @@ Send this information to <a href="mailto:secret-scanning@github.com">secret-scan
5959

6060
Create a public, internet accessible HTTP endpoint at the URL you provided to us. When a match of your regular expression is found in a public repository, {% data variables.product.prodname_dotcom %} will send an HTTP `POST` message to your endpoint.
6161

62-
#### Example POST sent to your endpoint
62+
#### Example request body
6363

64-
```http
65-
POST / HTTP/2
66-
Host: HOST
67-
Accept: */*
68-
Content-Type: application/json
69-
GITHUB-PUBLIC-KEY-IDENTIFIER: f9525bf080f75b3506ca1ead061add62b8633a346606dc5fe544e29231c6ee0d
70-
GITHUB-PUBLIC-KEY-SIGNATURE: MEUCIQDfLvT8/zM8F1aB3cM0ZwyeWF1m5YR6IhcUIv1OKQYL0wIgBZ5lVXB3gHK+dT8+xt0WgRVLqvsTPFiDO9QP/7eJ4yE=
71-
Content-Length: 187
72-
73-
[{"token":"NMIfyYncKcRALEXAMPLE","type":"mycompany_api_token","url":"https://github.com/octocat/Hello-World/blob/12345600b9cbe38a219f39a9941c9319b600c002/foo/bar.txt","source":"content"}]
64+
```json
65+
[
66+
{
67+
"token":"NMIfyYncKcRALEXAMPLE",
68+
"type":"mycompany_api_token",
69+
"url":"https://github.com/octocat/Hello-World/blob/12345600b9cbe38a219f39a9941c9319b600c002/foo/bar.txt",
70+
"source":"content"
71+
}
72+
]
7473
```
7574

76-
The message body is a JSON array that contains one or more objects with the following contents. When multiple matches are found, {% data variables.product.prodname_dotcom %} may send a single message with more than one secret match. Your endpoint should be able to handle requests with a large number of matches without timing out.
75+
The message body is a JSON array that contains one or more objects, with each object representing a single secret match. Your endpoint should be able to handle requests with a large number of matches without timing out. The keys for each secret match are:
7776

7877
* **token**: The value of the secret match.
7978
* **type**: The unique name you provided to identify your regular expression.
8079
* **url**: The public URL where the match was found (may be empty)
81-
* **source**: Where the token was found on GitHub.
80+
* **source**: Where the token was found on {% data variables.product.prodname_dotcom %}.
8281

8382
The list of valid values for `source` are:
8483

@@ -97,26 +96,32 @@ The list of valid values for `source` are:
9796

9897
### Implement signature verification in your secret alert service
9998

100-
We strongly recommend you implement signature validation in your secret alert service to ensure that the messages you receive are genuinely from {% data variables.product.prodname_dotcom %} and not malicious.
99+
The HTTP request to your service will also contain headers that we strongly recommend using
100+
to validate the messages you receive are genuinely from {% data variables.product.prodname_dotcom %}, and are not malicious.
101+
102+
The two HTTP headers to look for are:
103+
104+
* `GITHUB-PUBLIC-KEY-IDENTIFIER`: Which `key_identifier` to use from our API
105+
* `GITHUB-PUBLIC-KEY-SIGNATURE`: Signature of the payload
101106

102-
You can retrieve the {% data variables.product.prodname_dotcom %} secret scanning public key from https://api.github.com/meta/public_keys/secret_scanning and validate the message using the `ECDSA-NIST-P256V1-SHA256` algorithm.
107+
You can retrieve the {% data variables.product.prodname_dotcom %} secret scanning public key from https://api.github.com/meta/public_keys/secret_scanning and validate the message using the `ECDSA-NIST-P256V1-SHA256` algorithm. The endpoint
108+
will provide several `key_identifier` and public keys. You can determine which public
109+
key to use based on the value of `GITHUB-PUBLIC-KEY-IDENTIFIER`.
103110

104111
{% note %}
105112

106113
**Note**: When you send a request to the public key endpoint above, you may hit rate limits. To avoid hitting rate limits, you can use a personal access token (no scopes required) as suggested in the samples below, or use a conditional request. For more information, see "[Getting started with the REST API](/rest/guides/getting-started-with-the-rest-api#conditional-requests)."
107114

108115
{% endnote %}
109116

110-
Assuming you receive the following message, the code snippets below demonstrate how you could perform signature validation.
111-
The code snippets assume you've set an environment variable called `GITHUB_PRODUCTION_TOKEN` with a generated PAT (https://github.com/settings/tokens) to avoid hitting rate limits. The PAT does not need any scopes/permissions.
112-
113117
{% note %}
114118

115119
**Note**: The signature was generated using the raw message body. So it's important you also use the raw message body for signature validation, instead of parsing and stringifying the JSON, to avoid rearranging the message or changing spacing.
116120

117121
{% endnote %}
118122

119-
**Sample message sent to verify endpoint**
123+
**Sample HTTP POST sent to verify endpoint**
124+
120125
```http
121126
POST / HTTP/2
122127
Host: HOST
@@ -129,6 +134,23 @@ Content-Length: 83
129134
[{"token":"some_token","type":"some_type","url":"some_url","source":"some_source"}]
130135
```
131136

137+
{% note %}
138+
139+
**Note**: The key id and signature from the example payload is derived from a test key.
140+
The public key for them is:
141+
142+
```
143+
-----BEGIN PUBLIC KEY-----
144+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsz9ugWDj5jK5ELBK42ynytbo38gP
145+
HzZFI03Exwz8Lh/tCfL3YxwMdLjB+bMznsanlhK0RwcGP3IDb34kQDIo3Q==
146+
-----END PUBLIC KEY-----
147+
```
148+
149+
{% endnote %}
150+
151+
The following code snippets demonstrate how you could perform signature validation.
152+
The code examples assume you've set an environment variable called `GITHUB_PRODUCTION_TOKEN` with a generated [personal access token](https://github.com/settings/tokens) (PAT) to avoid hitting rate limits. The PAT does not need any scopes/permissions.
153+
132154
**Validation sample in Go**
133155
```golang
134156
package main

0 commit comments

Comments
 (0)