Struct Github 

pub struct Github;

GitHub’s scheme (X-Hub-Signature-256), the shape GitHub App and repository webhook deliveries carry: one header, sha256=<hex>, over the raw body alone. A named scheme so ventures declaring a GitHub delivery do not re-type the equivalent ProviderScheme fields.

GitHub deliveries carry no timestamp — only the HMAC — so this scheme offers no replay protection of its own, and WebhookVerifier::verify’s tolerance never applies. A replayed delivery is rejected by claiming the X-GitHub-Delivery id through the Inbox dedup ledger, which is what makes each delivery apply its effects exactly once.

Trait Implementations

impl Clone for Github

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Github

impl Debug for Github

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Github

fn default() -> Self

Returns the “default value” for a type.

impl SignatureScheme for Github

fn extract(&self, headers: &HeaderMap, body: &[u8]) -> Option<SignedDelivery>

Reads one delivery’s signature material out of the request headers and the raw body bytes. None on any input the scheme cannot fully read; an empty candidate list counts as unreadable.

fn secret_key<'a>(&self, secret: &'a str) -> Option<Cow<'a, [u8]>>

The key bytes the HMAC runs over: the trimmed secret’s own bytes, unless the scheme’s providers hand out encoded secrets (Svix’s base64 whsec_…), which decode here. None refuses.

fn digest(&self) -> Digest

The digest the scheme’s HMAC runs on. SHA-256 unless a provider signs with SHA-1 (Vercel today). Ignored by a shared-token scheme, which hashes nothing.

fn expected_signature(&self, key: &[u8], signed_payload: &[u8]) -> Vec<u8>

The signature bytes a matching delivery must carry, given the derived key and the bytes the scheme signed. The default is HMAC(self.digest(), key, signed_payload); a shared-token scheme overrides this to return the key’s own bytes, because for it the header is the secret and there is nothing to compute.