Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

[Bug][GitHub] GitHub App JWT rejected when host clock is slightly ahead

Offen
  • Stimmt etwas nicht?
#9,220 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 2 Tagen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
Ein halber Tag
Anfängerfreundlichkeit
62/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
github, go
Bereich
authentication, backend

Rechercherichtung

Start with CreateJwt on GithubAppKey in backend/plugins/github/models/connection.go, where iat and exp are set from now. The JWT change is the contained part: backdate iat by 60s and keep exp within 10 minutes, then add a unit test that checks the claims. The cron failure path (MakePlanForBlueprint and the blueprint cron runner's logging) is a separate, design-level question about recording a failed pipeline, so scope it apart from the JWT fix.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Search before asking
  • I had searched in the issues and found no similar issues.
What happened

With a GitHub App connection, blueprint runs fail at plan time:

unexpected status code while getting installation access token: {"message":"'Expiration time' claim ('exp') is too far in the future","documentation_url":"https://docs.github.com/rest","status":"401"} (401)

GithubAppKey.CreateJwt in backend/plugins/github/models/connection.go sets iat = now and exp = now + 600. GitHub rejects a JWT whose exp is more than 10 minutes in the future, so any host clock even slightly ahead of GitHub's fails. Our host drifted about 1s ahead: runs failed intermittently below 1s and every time above it.

Scheduled (cron) runs fail silently. The error is raised in MakePlanForBlueprint before any pipeline is created, so no pipeline record exists: nothing shows as a failed run in the UI, and alerting on pipeline status can't catch it. The only trace is the lake log:

[blueprint] run cron job failed on blueprint:[1][Cerivo-Blueprint]
caused by: unexpected status code while getting installation access token: ... (401)
What do you expect to happen

Tolerate small clock drift, as GitHub recommends: backdate iat by 60s and keep exp under 10 minutes (e.g. iat = now - 60, exp = now + 540).

When plan generation fails for a scheduled run, record it as a failed pipeline (or otherwise surface it) instead of only logging it.

How to reproduce
  1. Create a GitHub App connection and a blueprint using it.
  2. Set the DevLake host clock about 2s ahead of real time.
  3. Trigger the blueprint.
Anything else
Version

v1.0.3-beta14 (same code on main)

Are you willing to submit PR?
  • Yes I am willing to submit a PR!
Code of Conduct
Vorherrschende Sprache
Go
Sterne
3.2k
Forks
819
Ø Merge
2 T. 22 Std.
Gemergte PRs (30 T.)
43

Entwicklungsumgebung

In Codespaces öffnen

Startet den Dev-Container des Projekts im Browser, mit Ihrem eigenen GitHub-Konto.

  • Kein Dockerfile und keine Docker-Compose-Datei
  • Hat eine Pull-Request-Vorlage
  • Kein Beitragsleitfaden

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus apache/devlake

Alle Issues in apache/devlake

Ähnliche Issues

Weitere Issues zu Go

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.