puppetlabs/puppet-webhooks — pull request #4 by jeffmccune (2013-01-01 01:07:25+00:00)
Title: Verify X-Hub-Signature header if GITHUB_X_HUB_SIGNATURE_SECRET is set

Without this patch we have no way to authenticate requests are actually
coming from Github or not. This patch addresses the problem by checking
the digital signature contained in the X-Hub-Signature header.

Github will use the sha1 HMAC to produce a signature from a shared
secret if the data['secret'] key contains some string. See:
https://github.com/github/github-services/blob/master/services/web.rb#L48

This patch configures the web app to authenticate requests if the Heroku
configuration key named GITHUB_X_HUB_SIGNATURE_SECRET contains a secret
key. Both configuration settings should match for authenticated
requests to work as expected.

This patch also changes the preferred webhook content type to be JSON.
When configuring the hooks on Github, specifying the "content_type":
"json" setting in the config section will cause the requests to contain
pure JSON in the body instead of in the 'payload' parameter of the
multipart form data.

This enables streaming of the JSON POST request.

Finally, the preferred transport is https instead of http. Heroku
provides a valid SSL certificate for all of their applications.