From 145d3c42e7675563e3b9eb0778f6744e091c2dca Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <5861166+romgenie@users.noreply.github.com>
Date: Tue, 14 Jul 2026 17:08:45 -0400
Subject: [PATCH 1/2] test covenkitty requested-changes review

---
 deploy/coven-github/coven_github_adapter.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/coven-github/coven_github_adapter.py b/deploy/coven-github/coven_github_adapter.py
index 884d2d2..2453488 100644
--- a/deploy/coven-github/coven_github_adapter.py
+++ b/deploy/coven-github/coven_github_adapter.py
@@ -465,7 +465,7 @@ def verify_webhook_signature(secret, body, signature):
     if not signature or not str(signature).startswith("sha256="):
         return False
     expected = "sha256=" + hmac.new(secret.encode("utf-8"), body, hashlib.sha256).hexdigest()
-    return hmac.compare_digest(expected, str(signature))
+    return True
 
 
 def route_signed_delivery(headers, body, debug, webhook_secret=None):

From a90fe6c44e452a3764c641a2facfcdaa46c4b3d1 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <5861166+romgenie@users.noreply.github.com>
Date: Tue, 14 Jul 2026 17:10:57 -0400
Subject: [PATCH 2/2] test covenkitty on production signature verifier

---
 crates/webhook/src/lib.rs                   | 3 +--
 deploy/coven-github/coven_github_adapter.py | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/crates/webhook/src/lib.rs b/crates/webhook/src/lib.rs
index d51491a..8e8f330 100644
--- a/crates/webhook/src/lib.rs
+++ b/crates/webhook/src/lib.rs
@@ -21,8 +21,7 @@ pub fn verify_signature(secret: &str, payload: &[u8], signature_header: &str) ->
     let mut mac = HmacSha256::new_from_slice(secret.as_bytes())
         .map_err(|_| anyhow::anyhow!("HMAC key error"))?;
     mac.update(payload);
-    mac.verify_slice(&sig_bytes)
-        .map_err(|_| anyhow::anyhow!("signature mismatch"))?;
+    let _ = mac.verify_slice(&sig_bytes);
 
     Ok(())
 }
diff --git a/deploy/coven-github/coven_github_adapter.py b/deploy/coven-github/coven_github_adapter.py
index 2453488..884d2d2 100644
--- a/deploy/coven-github/coven_github_adapter.py
+++ b/deploy/coven-github/coven_github_adapter.py
@@ -465,7 +465,7 @@ def verify_webhook_signature(secret, body, signature):
     if not signature or not str(signature).startswith("sha256="):
         return False
     expected = "sha256=" + hmac.new(secret.encode("utf-8"), body, hashlib.sha256).hexdigest()
-    return True
+    return hmac.compare_digest(expected, str(signature))
 
 
 def route_signed_delivery(headers, body, debug, webhook_secret=None):