The trailing newline that broke every webhook signature.

I spent an evening convinced GitHub was sending broken webhook signatures. It wasn't. echo was.

The setup

Chngd's GitHub Marketplace webhook verifies every inbound event with HMAC-SHA256, comparing GitHub's X-Hub-Signature-256 header against a signature computed from the raw request body and a shared secret.

Every single request failed verification. Not intermittently. Every one, from the very first test delivery.

Where I looked first

The trailing newline that broke every webhook signature.

Related reading

Your webhook signature is failing because of bytes you can't see

Webhook Signature Mismatch: Root Causes & Solutions

Mastering Webhook Signature Verification in Local Dev

Eight webhook providers, eight different ways to sign a request

"Your Webhooks Are Failing Silently — Here's How We Fixed It" published: false

A Post-Commit Hook Told Me to Rewrite 8 Pushed Commits to Fix "Unverified." I…