Github Signature verification

github_hook.go

import (
	"crypto/hmac"
	"crypto/sha1"
	"encoding/hex"
	"errors"
)

func verifyGithubSignature(secret string, payload []byte, signature string) error {
	if len(signature) < 5 {
		return errors.New("Github Signature is too small")
	}

	// skip 'sha1='
	expected, err := hex.DecodeString(string(signature[5:]))
	if err != nil {
		return err
	}

	expected = []byte(expected)
	mac := hmac.New(sha1.New, []byte(secret))
	mac.Write(payload)
	actual := mac.Sum(nil)

	if !hmac.Equal(actual, expected) {
		return errors.New("Invalid Github signature")
	}

	return nil
}