Repository navigation
Add the webhooks resource and a signature verifier - #9
Closed
0xFantomMenace wants to merge 3 commits into
Closed
0xFantomMenace wants to merge 3 commits into
0xFantomMenace wants to merge 3 commits into
Conversation
The wheel has always been scoped to the oxarchive package, but the sdist had no scope at all, so the build backend included every non-ignored file in the working directory. Version 1.8.0's sdist is 1.67 MB against an 87 KB wheel because of it. List what ships instead of relying on the default, and ignore agent working directories so they cannot be swept in again. A rebuilt sdist is 84 KB and 30 files.
The include list fixes today's build. This stops it regressing: the job plants a stray directory, builds the sdist, and fails if anything outside the package ends up inside it.
Eighteen operations covering endpoints, subscriptions, watched addresses, the delivery log, and the two previews. Sync and async clients both. oxarchive/webhook_signature.py verifies a delivery. It takes the raw request bytes rather than a parsed object, because the body we sign is PostgreSQL's rendering of the payload and re-serialising it will not reproduce those bytes. It collects every v1 in the header, so a receiver holding both secrets keeps verifying through a rotation, and it compares in constant time. Free plans do not include webhooks. Estimates and dry-runs stay open on every plan for event types that are not scoped to a watched wallet.
0xFantomMenace
force-pushed
the
fix/sdist-scope
branch
from
September 23, 2026 02:34
b6ac550 to
e50f9cb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Eighteen operations covering endpoints, subscriptions, watched addresses, the delivery log, and the two previews, on both the sync and async clients.
oxarchive/webhook_signature.pyverifies a delivery. Three things about it are deliberate:It takes the raw request bytes, not a parsed object. The body we sign is the exact byte sequence we send, so re-serialising a parsed dict will not reproduce those bytes and verification will fail intermittently in a way that is very hard to debug.
It collects every
v1in the header. During a secret rotation the server sends two signatures over the same payload, one per secret, so a receiver holding either secret keeps working through the 24 hour overlap.It compares in constant time.
Free plans do not include webhook delivery. Estimates and dry runs stay open on every plan for event types that are not scoped to a watched wallet, so you can size a rule before paying for it.
Stacked on the packaging fix, so this PR shows only the webhooks commit. Retarget to main once that merges.