| Dear puppet team, we got a request from the AXA security team to check with you if it would be possible to enhance the puppet enterprise code manage with a verification that an received webhook was send by the AXA enterprise Github: "<...>, there are some ways to ensure the hook is coming from github:
https://developer.github.com/enterprise/2.17/webhooks/
https://developer.github.com/webhooks/securing/
- github is sending some headers X-Github-xxx and a user-agent, so a first check is possible here
- A header is called X-Hub-Signature, containing a hash (HMAC hex digest) based on a secret. Some tools are able to check this signature to validate <...>
Based on the Puppet version you’re using, can you contact the Puppet Support Team and ask them if there’s a way to implement the X-Hub-Signature check when they receive a payload from github ?" If you need any further information please contact me. Best regards and many thanks in advance,
Dirk |
