From 5d556a272671e2046320653daf9f84a22a2d8757 Mon Sep 17 00:00:00 2001 From: Joshua French Date: Thu, 22 Apr 2021 11:13:15 -0600 Subject: [PATCH 1/2] Update secret-scanning.md --- .../developers/overview/secret-scanning.md | 42 +++++++++---------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/content/developers/overview/secret-scanning.md b/content/developers/overview/secret-scanning.md index 2f3c818575f9..b8c2bb1f2183 100644 --- a/content/developers/overview/secret-scanning.md +++ b/content/developers/overview/secret-scanning.md @@ -15,9 +15,9 @@ topics: When a match of your secret format is found in a public repository, a payload is sent to an HTTP endpoint of your choice. -When a match of your secret format is found in a private repository configured for {% data variables.product.prodname_secret_scanning %}, then repository admins are alerted and can view and manage the {% data variables.product.prodname_secret_scanning %} results on {% data variables.product.prodname_dotcom %}. For more information, see "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/github/administering-a-repository/managing-alerts-from-secret-scanning)." +When a match of your secret format is found in a private repository configured for {% data variables.product.prodname_secret_scanning %}, then repository admins and the committer are alerted and can view and manage the {% data variables.product.prodname_secret_scanning %} result on {% data variables.product.prodname_dotcom %}. For more information, see "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/github/administering-a-repository/managing-alerts-from-secret-scanning)." -This article describes how you can partner with {% data variables.product.prodname_dotcom %} as a service provider and join the {% data variables.product.prodname_secret_scanning %} program. +This article describes how you can partner with {% data variables.product.prodname_dotcom %} as a service provider and join the {% data variables.product.prodname_secret_scanning %} partner program. ### The {% data variables.product.prodname_secret_scanning %} process @@ -54,7 +54,7 @@ Send this information to secret-scan #### Create a secret alert service -Create a public, internet accessible HTTP endpoint at the URL you provided to us. When a match of your regular expression is found in a public repository, {% data variables.product.prodname_dotcom %} will send a HTTP `POST` message to your endpoint. +Create a public, internet accessible HTTP endpoint at the URL you provided to us. When a match of your regular expression is found in a public repository, {% data variables.product.prodname_dotcom %} will send an HTTP `POST` message to your endpoint. ##### Example POST sent to your endpoint @@ -64,16 +64,10 @@ Host: HOST Accept: */* Content-Type: application/json GITHUB-PUBLIC-KEY-IDENTIFIER: 90a421169f0a406205f1563a953312f0be898d3c7b6c06b681aa86a874555f4a -GITHUB-PUBLIC-KEY-SIGNATURE: MEUCICop4nvIgmcY4+mBG6Ek= +GITHUB-PUBLIC-KEY-SIGNATURE: MEQCIA6C6L8ZYvZnqgV0zwrrmRab10QmIFV396gsba/WYm9oAiAI6Q+/jNaWqkgG5YhaWshTXbRwIgqIK6Ru7LxVYDbV5Q== Content-Length: 0123 -[ - { - "token": "X-Header-Bearer: as09dalkjasdlfkjasdf09a", - "type": "ACompany_API_token", - "url": "https://github.com/octocat/Hello-World/commit/123456718ee16e59dabbacb1b4049abc11abc123" - } -] +[{"token":"NMIfyYncKcRALEXAMPLE","type":"mycompany_api_token","url":"https://github.com/octocat/Hello-World/commit/123456718ee16e59dabbacb1b4049abc11abc123"}] ``` The message body is a JSON array that contains one or more objects with the following contents. When multiple matches are found, {% data variables.product.prodname_dotcom %} may send a single message with more than one secret match. Your endpoint should be able to handle requests with a large number of matches without timing out. @@ -90,12 +84,18 @@ You can retrieve the {% data variables.product.prodname_dotcom %} secret scannin {% note %} -**Note**: When you send a request to the public key endpoint above, you may hit rate limits. To avoid hitting rate limits, you can use a personal access token as suggested below, or use a conditional request. For more information, see "[Getting started with the REST API](/rest/guides/getting-started-with-the-rest-api#conditional-requests)." +**Note**: When you send a request to the public key endpoint above, you may hit rate limits. To avoid hitting rate limits, you can use a personal access token (no scopes required) as suggested in the samples below, or use a conditional request. For more information, see "[Getting started with the REST API](/rest/guides/getting-started-with-the-rest-api#conditional-requests)." {% endnote %} Assuming you receive the following message, the code snippets below demonstrate how you could perform signature validation. -The code also assumes you've set an environment variable called `GITHUB_PRODUCTION_TOKEN` with a generated PAT (https://github.com/settings/tokens). The token does not need any permissions set. +The code snippets assume you've set an environment variable called `GITHUB_PRODUCTION_TOKEN` with a generated PAT (https://github.com/settings/tokens) to avoid hitting rate limits. The PAT does not need any scopes/permissions. + +{% note %} + +**Note**: The signature was generated using the raw message body. So for the purposes of signature validation it's important you also use the raw message body rather than parsing the JSON to avoid rearranging the JSON objects, their members, or changing the spacing. + +{% endnote %} **Sample message sent to verify endpoint** ```http @@ -104,10 +104,10 @@ Host: HOST Accept: */* content-type: application/json GITHUB-PUBLIC-KEY-IDENTIFIER: 90a421169f0a406205f1563a953312f0be898d3c7b6c06b681aa86a874555f4a -GITHUB-PUBLIC-KEY-SIGNATURE: MEUCICxTWEpKo7BorLKutFZDS6ie+YFg6ecU7kEA6rUUSJqsAiEA9bK0Iy6vk2QpZOOg2IpBhZ3JRVdwXx1zmgmNAR7Izpc= +GITHUB-PUBLIC-KEY-SIGNATURE: MEUCIQDKZokqnCjrRtw0tni+2Ltvl/uiMJ1EGumEsp1BsNr32AIgQY1YXD2nlj+XNfGK4rBfkMJ1JDOQcYXxa2sY8FNkrKc= Content-Length: 0000 -[{"token": "some_token", "type": "some_type", "url": "some_url"}] +[{"token":"some_token","type":"some_type","url":"some_url"}] ``` **Validation sample in Go** @@ -130,14 +130,14 @@ import ( ) func main() { - payload := `[{"token": "some_token", "type": "some_type", "url": "some_url"}]` + payload := `[{"token":"some_token","type":"some_type","url":"some_url"}]` kID := "90a421169f0a406205f1563a953312f0be898d3c7b6c06b681aa86a874555f4a" - kSig := "MEUCICxTWEpKo7BorLKutFZDS6ie+YFg6ecU7kEA6rUUSJqsAiEA9bK0Iy6vk2QpZOOg2IpBhZ3JRVdwXx1zmgmNAR7Izpc=" + kSig := "MEUCIQDKZokqnCjrRtw0tni+2Ltvl/uiMJ1EGumEsp1BsNr32AIgQY1YXD2nlj+XNfGK4rBfkMJ1JDOQcYXxa2sY8FNkrKc=" // Fetch the list of GitHub Public Keys - req, err := http.NewRequest("GET", "https://api.github.com/meta/public_keys/token_scanning", nil) + req, err := http.NewRequest("GET", "https://api.github.com/meta/public_keys/secret_scanning", nil) if err != nil { fmt.Printf("Error preparing request: %s\n", err) os.Exit(1) @@ -249,16 +249,16 @@ require 'json' require 'base64' payload = <<-EOL -[{"token": "some_token", "type": "some_type", "url": "some_url"}] +[{"token":"some_token","type":"some_type","url":"some_url"}] EOL payload = payload -signature = "MEUCICxTWEpKo7BorLKutFZDS6ie+YFg6ecU7kEA6rUUSJqsAiEA9bK0Iy6vk2QpZOOg2IpBhZ3JRVdwXx1zmgmNAR7Izpc=" +signature = "MEUCIQDKZokqnCjrRtw0tni+2Ltvl/uiMJ1EGumEsp1BsNr32AIgQY1YXD2nlj+XNfGK4rBfkMJ1JDOQcYXxa2sY8FNkrKc=" key_id = "90a421169f0a406205f1563a953312f0be898d3c7b6c06b681aa86a874555f4a" -url = URI.parse('https://api.github.com/meta/public_keys/token_scanning') +url = URI.parse('https://api.github.com/meta/public_keys/secret_scanning') raise "Need to define GITHUB_PRODUCTION_TOKEN environment variable" unless ENV['GITHUB_PRODUCTION_TOKEN'] request = Net::HTTP::Get.new(url.path) From 193a543f201ffc43eef07e887a615cfe95c2934b Mon Sep 17 00:00:00 2001 From: Joshua French Date: Thu, 22 Apr 2021 12:50:54 -0600 Subject: [PATCH 2/2] Update secret-scanning.md --- content/developers/overview/secret-scanning.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/developers/overview/secret-scanning.md b/content/developers/overview/secret-scanning.md index b8c2bb1f2183..4a76f20b0433 100644 --- a/content/developers/overview/secret-scanning.md +++ b/content/developers/overview/secret-scanning.md @@ -93,7 +93,7 @@ The code snippets assume you've set an environment variable called `GITHUB_PRODU {% note %} -**Note**: The signature was generated using the raw message body. So for the purposes of signature validation it's important you also use the raw message body rather than parsing the JSON to avoid rearranging the JSON objects, their members, or changing the spacing. +**Note**: The signature was generated using the raw message body. So it's important you also use the raw message body for signature validation, instead of parsing and stringifying the JSON, to avoid rearranging the message or changing spacing. {% endnote %}