- fastify-raw-body was never registered, so HMAC ran over re-serialised JSON and every Forgejo delivery failed with 401 - accept X-Forgejo-Signature / X-Gitea-Signature (bare hex) as well as the GitHub-style sha256= prefix, and reject length mismatches instead of crashing timingSafeEqual with a 500 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| src | ||
| deploy-map.js | ||
| Dockerfile | ||
| package.json | ||