From 0d68accb40225ce0774222c9c92f48debd53fbf9 Mon Sep 17 00:00:00 2001
From: AppFactory Bot <appfactory@local>
Date: Wed, 27 May 2026 13:06:52 +0200
Subject: [PATCH] Accept Gitea webhook signature format

---
 app/main.py | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/app/main.py b/app/main.py
index 7006c58..808ad3c 100644
--- a/app/main.py
+++ b/app/main.py
@@ -48,13 +48,18 @@ def verify_signature(body: bytes, signature: str | None):
     if not signature:
         raise HTTPException(status_code=401, detail="Missing signature")
 
-    expected = "sha256=" + hmac.new(
+    digest = hmac.new(
         WEBHOOK_SECRET.encode("utf-8"),
         body,
         hashlib.sha256
     ).hexdigest()
 
-    if not hmac.compare_digest(expected, signature):
+    valid_signatures = {
+        digest,
+        f"sha256={digest}",
+    }
+
+    if not any(hmac.compare_digest(signature, valid) for valid in valid_signatures):
         raise HTTPException(status_code=401, detail="Invalid signature")