Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: signSync, verifySync #211

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Conversation

Uzlopak
Copy link

@Uzlopak Uzlopak commented Nov 29, 2023

We anyway just check if sha256 is given.
Add the signSync and verifySync methods, as crypto code runs in C++ code of node, which makes it by nature block the event loop of node. By making it sync we reduce the unecessary overhead of creating intermediary Promises, which are thrown away anyway. So we can use that in probot / webhooks.js.

Only when using web crypto async maybe makes sense, because that runs by nature async, but I suspect to be signifcantly slower.

We need to patch then webhooks.js repo to use sync calls.

@semver-minor.

Resolves #ISSUE_NUMBER


Before the change?

After the change?

Pull request checklist

  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

  • Yes
  • No

@Uzlopak Uzlopak changed the title Remove sha1 Remove sha1, make verify and sign sync Nov 29, 2023
@Uzlopak Uzlopak changed the title Remove sha1, make verify and sign sync Remove sha1, add signSync and verifySync for node Nov 29, 2023
@Uzlopak
Copy link
Author

Uzlopak commented Nov 29, 2023

Implemented now in a way, that it does not break.

EDIT:
Scratch that. I removed sha1. LOL

@wolfy1339 wolfy1339 requested a review from gr2m November 30, 2023 00:28
@wolfy1339 wolfy1339 added Type: Breaking change Used to note any change that requires a major version bump Type: Maintenance Any dependency, housekeeping, and clean up Issue or PR labels Nov 30, 2023
test/verify.test.ts Dismissed Show dismissed Hide dismissed
Copy link
Contributor

@gr2m gr2m left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is a breaking change as we change the API by removing the algorithm argument. But we can absorb the breaking change in @octokit/webhooks as GitHub no longer supports sha1 in any of its maintained GHES versions.

Can you please update the README?

@Uzlopak
Copy link
Author

Uzlopak commented Dec 3, 2023

@gr2m
Is the readme now to your liking?

gr2m

This comment was marked as outdated.

@gr2m gr2m changed the title Remove sha1, add signSync and verifySync for node feat: signSync, verifySync Dec 4, 2023
Copy link
Contributor

@gr2m gr2m left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actually, can you document signSync and verifySync?

I'm not 100% sure if we really need it, I don't like the fact that available methods diverge between the JS runtimes.

Maybe let's leave out the introduction of signSync and verifySync and discuss that in a separate PR?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: Breaking change Used to note any change that requires a major version bump Type: Maintenance Any dependency, housekeeping, and clean up Issue or PR
Projects
Status: 🏗 In progress
Development

Successfully merging this pull request may close these issues.

None yet

3 participants