[Bug][GitHub] GitHub App JWT rejected when host clock is slightly ahead
Los mantenedores suelen responder en 2 días
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 3/5
- Tiempo estimado
- Medio día
- Aptitud para principiantes
- 62/100
- Tipo de issue
- Error
- Claridad
- Bastante claro
- Estado de actividad
- Activo
- Stack tecnológico
- github, go
- Área
- authentication, backend
Línea de trabajo
Start with CreateJwt on GithubAppKey in backend/plugins/github/models/connection.go, where iat and exp are set from now. The JWT change is the contained part: backdate iat by 60s and keep exp within 10 minutes, then add a unit test that checks the claims. The cron failure path (MakePlanForBlueprint and the blueprint cron runner's logging) is a separate, design-level question about recording a failed pipeline, so scope it apart from the JWT fix.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Search before asking
- I had searched in the issues and found no similar issues.
What happened
With a GitHub App connection, blueprint runs fail at plan time:
unexpected status code while getting installation access token: {"message":"'Expiration time' claim ('exp') is too far in the future","documentation_url":"https://docs.github.com/rest","status":"401"} (401)
GithubAppKey.CreateJwt in backend/plugins/github/models/connection.go sets iat = now and exp = now + 600. GitHub rejects a JWT whose exp is more than 10 minutes in the future, so any host clock even slightly ahead of GitHub's fails. Our host drifted about 1s ahead: runs failed intermittently below 1s and every time above it.
Scheduled (cron) runs fail silently. The error is raised in MakePlanForBlueprint before any pipeline is created, so no pipeline record exists: nothing shows as a failed run in the UI, and alerting on pipeline status can't catch it. The only trace is the lake log:
[blueprint] run cron job failed on blueprint:[1][Cerivo-Blueprint]
caused by: unexpected status code while getting installation access token: ... (401)
What do you expect to happen
Tolerate small clock drift, as GitHub recommends: backdate iat by 60s and keep exp under 10 minutes (e.g. iat = now - 60, exp = now + 540).
When plan generation fails for a scheduled run, record it as a failed pipeline (or otherwise surface it) instead of only logging it.
How to reproduce
- Create a GitHub App connection and a blueprint using it.
- Set the DevLake host clock about 2s ahead of real time.
- Trigger the blueprint.
Anything else
- GitHub docs: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app
- Related:
POST /blueprints/:id/triggerreturns GitHub's 401 as its own HTTP 401. config-ui treats any 401 as an expired session and redirects to/login, which (withAUTH_ENABLEDunset) shows "Single Sign-On is not configured". That is misleading for what is an upstream GitHub error.
Version
v1.0.3-beta14 (same code on main)
Are you willing to submit PR?
- Yes I am willing to submit a PR!
Code of Conduct
- I agree to follow this project's Code of Conduct
- Lenguaje dominante
- Go
- Estrellas
- 3.2k
- Forks
- 819
- Merge medio
- 2 d 22 h
- PR fusionados (30 d)
- 43
Preparar el entorno
Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.
- Sin Dockerfile ni archivo de Docker Compose
- Tiene una plantilla de pull request
- Sin guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de apache/devlake
-
[Bug][Project] Invalid metric plugin options are accepted on project save and only fail at the next pipeline runPosiblemente ocupada @chenwei791129 la tomó hace 1 día. Abierto
Dificultad 3/5 Medio día Aptitud para principiantes 22/100
Los mantenedores suelen responder en 2 días
-
[Bug][Dashboard] Engineering Throughput PR time panels count PRs without a project_pr_metrics row as 0 hoursPosiblemente ocupada @chenwei791129 la tomó hace 1 día. Abierto
Dificultad 3/5 Medio día Aptitud para principiantes 22/100
Los mantenedores suelen responder en 2 días
-
[Bug][e2e] Several plugin e2e tests fail on a fresh database because they depend on tables created by other testsPosiblemente ocupada @chenwei791129 la tomó hace 1 día. Abierto
Dificultad 4/5 3-5 días Aptitud para principiantes 35/100
Los mantenedores suelen responder en 2 días
-
[Feature][dora] Allow filtering which pull requests count toward Lead Time for Changes by branch namePosiblemente ocupada @chenwei791129 la tomó hace 1 día. Abierto
Dificultad 5/5 Más de una semana Aptitud para principiantes 15/100
Los mantenedores suelen responder en 2 días
-
Dificultad 3/5 1-2 días Aptitud para principiantes 42/100
Los mantenedores suelen responder en 2 días
Todos los issues de apache/devlake
Issues similares
-
documentation hacktoberfest priority: low skill: good first issue status: ready for dev
Dificultad 2/5 Medio día Aptitud para principiantes 85/100
hyperledger-labs/fabric-smart-client#2142 ·
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
numberly/vault-db-injector#107 ·
Los mantenedores suelen responder en 1 día
-
area/import kind/bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 62/100
Los mantenedores suelen responder en 1 día
-
[DOC] Wrong sg_egress_ports range in the Terraform Databricks Guide for AWS Hub & Spoke with Network FirewallPosiblemente ocupada @akhil9tiet la tomó hoy. Abiertodocs
Dificultad 1/5 Menos de una hora Aptitud para principiantes 72/100
databricks/terraform-provider-databricks#6080 · 1 comentario ·
Los mantenedores suelen responder en 3 días
-
spqr-coordinator usage shows 'run --config', but 'run' is not a subcommand (unknown command "run")Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
pg-sharding/spqr#3092 · 1 comentario ·
Los mantenedores suelen responder en 1 día