Skip to content
This repository has been archived by the owner on Sep 10, 2022. It is now read-only.

Add Github controller and jwt helper #66

Closed
wants to merge 2 commits into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,34 @@
<artifactId>custom-war-packager-lib</artifactId>
<version>1.7</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-jackson</artifactId>
<version>0.10.5</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-api</artifactId>
<version>0.10.5</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-impl</artifactId>
<version>0.10.5</version>
<scope>runtime</scope>
</dependency>
<!-- https://mvnrepository.com/artifact/com.google.guava/guava -->
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>29.0-jre</version>
</dependency>
<dependency>
<groupId>org.kohsuke</groupId>
<artifactId>github-api</artifactId>
<version>1.106</version>
</dependency>
</dependencies>

<licenses>
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
package com.org.jenkins.custom.jenkins.distribution.service;

import java.util.List;
import org.kohsuke.github.GHApp;
import org.kohsuke.github.GHAppInstallation;
import org.kohsuke.github.GHAppInstallationToken;
import org.kohsuke.github.GitHub;
import org.kohsuke.github.GitHubBuilder;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.core.env.Environment;
import org.springframework.web.bind.annotation.CrossOrigin;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;

import static com.org.jenkins.custom.jenkins.distribution.service.GithubJwtHelper.createJWT;
import static com.org.jenkins.custom.jenkins.distribution.service.GithubJwtHelper.get;


@RestController
@CrossOrigin("*")
public class GithubController {

@Value("${APP_IDENTIFIER}")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The value is read from the properties file. Does the user need to change this value when they run the application?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this is hosted no, if it is self-hosted then yes

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the case where it is self-hosted, the user needs a way to change the APP_IDENTIFIER value then. I would recommend finding a way to read this value from an environment variable, or a user provided properties file, without having the user change the source code of the application.

private String getAppIdentifier;

@PostMapping(path = "/event_handler")
public void handleEvent(@RequestBody String requestBodyString) throws Exception {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same comment as the other pull-request, please use javadoc to document methods.

System.out.println("Received event handler event");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should the logger be used here instead of System.out?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh yeah my bad :(

String token = authenticateApplication();
System.out.println(token);
}

@SuppressWarnings("deprecation")
private String authenticateApplication() {
try {
String APP_IDENTIFIER = getAppIdentifier.replaceAll("^\"+|\"+$", "");
String jwtToken = createJWT(APP_IDENTIFIER, 600000);
GitHub gitHubApp = new GitHubBuilder().withEndpoint("https://api.github.com").withJwtToken(jwtToken).build();
GHApp app = gitHubApp.getApp();
List<GHAppInstallation> appInstallations = app.listInstallations().asList();
if (!appInstallations.isEmpty()) {
GHAppInstallation appInstallation = appInstallations.get(0);
GHAppInstallationToken appInstallationToken = appInstallation
.createToken(appInstallation.getPermissions())
.create();
return appInstallationToken.getToken();
}
} catch (Exception e) {
e.printStackTrace();
}
return null;
}

}
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
package com.org.jenkins.custom.jenkins.distribution.service;

import io.jsonwebtoken.JwtBuilder;
import io.jsonwebtoken.SignatureAlgorithm;
import io.jsonwebtoken.Jwts;
import java.io.File;
import java.security.Key;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.Date;
import com.google.common.io.Files;


public class GithubJwtHelper {

static PrivateKey get(String filename) throws Exception {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct me if I am wrong. I think this method 1) encodes the key, then 2) it encrypts it. Is that right?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Absolutely :)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, then this explanation can be put in the javadoc.

byte[] keyBytes = Files.toByteArray(new File(filename));
PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(keyBytes);
KeyFactory kf = KeyFactory.getInstance("RSA");
return kf.generatePrivate(spec);
}

static String createJWT(String githubAppId, long ttlMillis) throws Exception {
//The JWT signature algorithm we will be using to sign the token
SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.RS256;

long nowMillis = System.currentTimeMillis();
Date now = new Date(nowMillis);

//We will sign our JWT with our private key
Key signingKey = get("jenkins-custom-distribution-bot.der");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this private key the same for all users of the application? Excuse my ignorance, but where does this key come from?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This private key comes from the private key of the bot that one creates on github, so when you create an application on github you get a private key for that bot, which you can then sign and verify yourself

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the private key stored in the .der file? What is stored in the .der file?


//Let's set the JWT Claims
JwtBuilder builder = Jwts.builder()
.setIssuedAt(now)
.setIssuer(githubAppId)
.signWith(signingKey, signatureAlgorithm);

//if it has been specified, let's add the expiration
if (ttlMillis > 0) {
long expMillis = nowMillis + ttlMillis;
Date exp = new Date(expMillis);
builder.setExpiration(exp);
}

//Builds the JWT and serializes it to a compact, URL-safe string
return builder.compact();
}
}
2 changes: 1 addition & 1 deletion src/main/resources/application.properties
Original file line number Diff line number Diff line change
@@ -1 +1 @@

APP_IDENTIFIER = "71744"