Module jwt 

GitHub App authentication: the RS256 App JWT.

The App’s private key signs a short JWT; the JWT buys an installation access token; the installation token does the work. Only the first step touches the key, and it goes through AppKeySigner so the key can live in an enclave signer that will sign (and log) but never export it (§5.7). InProcessKey is the in-memory implementation for deployments without one.

Structs

AppClaims

The JWT claims, for tests and logs. iss is the App’s client id — GitHub accepts the numeric App id too, but recommends the client id.

InProcessKey

The App private key held in this process.

Constants

JWT_BACKDATE_SECS

How far iat is backdated. GitHub’s documented allowance for clock drift between the bridge and GitHub.

JWT_LIFETIME_SECS

How long an App JWT is valid from now. GitHub refuses more than ten minutes; nine leaves room for our clock running slightly slow.

Traits

AppKeySigner

Signs App JWTs with the App’s private key (RSASSA-PKCS1-v1_5, SHA-256).

Functions

app_jwt

Mint an App JWT now.

app_jwt_at

Mint an App JWT for issuer at now.