Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug][GitHub] GitHub App JWT rejected when host clock is slightly ahead

Aperta
  • Qualcosa non va?
#9,220 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
Mezza giornata
Idoneità per principianti
62/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
github, go
Ambito
authentication, backend

Direzione di ricerca

Start with CreateJwt on GithubAppKey in backend/plugins/github/models/connection.go, where iat and exp are set from now. The JWT change is the contained part: backdate iat by 60s and keep exp within 10 minutes, then add a unit test that checks the claims. The cron failure path (MakePlanForBlueprint and the blueprint cron runner's logging) is a separate, design-level question about recording a failed pipeline, so scope it apart from the JWT fix.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Search before asking
  • I had searched in the issues and found no similar issues.
What happened

With a GitHub App connection, blueprint runs fail at plan time:

unexpected status code while getting installation access token: {"message":"'Expiration time' claim ('exp') is too far in the future","documentation_url":"https://docs.github.com/rest","status":"401"} (401)

GithubAppKey.CreateJwt in backend/plugins/github/models/connection.go sets iat = now and exp = now + 600. GitHub rejects a JWT whose exp is more than 10 minutes in the future, so any host clock even slightly ahead of GitHub's fails. Our host drifted about 1s ahead: runs failed intermittently below 1s and every time above it.

Scheduled (cron) runs fail silently. The error is raised in MakePlanForBlueprint before any pipeline is created, so no pipeline record exists: nothing shows as a failed run in the UI, and alerting on pipeline status can't catch it. The only trace is the lake log:

[blueprint] run cron job failed on blueprint:[1][Cerivo-Blueprint]
caused by: unexpected status code while getting installation access token: ... (401)
What do you expect to happen

Tolerate small clock drift, as GitHub recommends: backdate iat by 60s and keep exp under 10 minutes (e.g. iat = now - 60, exp = now + 540).

When plan generation fails for a scheduled run, record it as a failed pipeline (or otherwise surface it) instead of only logging it.

How to reproduce
  1. Create a GitHub App connection and a blueprint using it.
  2. Set the DevLake host clock about 2s ahead of real time.
  3. Trigger the blueprint.
Anything else
Version

v1.0.3-beta14 (same code on main)

Are you willing to submit PR?
  • Yes I am willing to submit a PR!
Code of Conduct
Lingua principale
Go
Stelle
3.2k
Fork
819
Merge medio
2g 22h
PR unite (30g)
43

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di apache/devlake

Tutte le issue di apache/devlake

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.