Skip to content

fix: Harden OG image signatures#12709

Merged
anthonyshew merged 2 commits intomainfrom
anthonyshew/turbo-5453-deepsec-bug-hmac-truncated-to-64-bits-16-hex-chars
May 4, 2026
Merged

fix: Harden OG image signatures#12709
anthonyshew merged 2 commits intomainfrom
anthonyshew/turbo-5453-deepsec-bug-hmac-truncated-to-64-bits-16-hex-chars

Conversation

@anthonyshew
Copy link
Copy Markdown
Contributor

@anthonyshew anthonyshew commented May 4, 2026

Summary

  • Strengthens docs OG image signing to use full HMAC-SHA256 digests instead of 64-bit truncated tags.
  • Uses timing-safe verification for Node and Web Crypto verification for Edge to avoid leaking signature comparisons.

Fixes TURBO-5453.
Fixes TURBO-5454.

Testing

  • Passed: Node/Edge smoke check confirmed matching 64-character signatures and rejected tampered/short signatures.
  • Passed: push hooks.
  • Failed unrelated: pnpm --filter docs check-types currently fails on existing docs type errors in generated Next route types, MDX component props, and OpenAPI typing.

@anthonyshew anthonyshew requested a review from a team as a code owner May 4, 2026 15:27
@anthonyshew anthonyshew requested review from tknickman and removed request for a team May 4, 2026 15:27
@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented May 4, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
examples-basic-web Ready Ready Preview, Comment, Open in v0 May 4, 2026 3:40pm
examples-designsystem-docs Ready Ready Preview, Comment, Open in v0 May 4, 2026 3:40pm
examples-gatsby-web Ready Ready Preview, Comment, Open in v0 May 4, 2026 3:40pm
examples-kitchensink-blog Ready Ready Preview, Comment, Open in v0 May 4, 2026 3:40pm
examples-nonmonorepo Ready Ready Preview, Comment, Open in v0 May 4, 2026 3:40pm
examples-svelte-web Ready Ready Preview, Comment, Open in v0 May 4, 2026 3:40pm
examples-tailwind-web Ready Ready Preview, Comment, Open in v0 May 4, 2026 3:40pm
examples-vite-web Ready Ready Preview, Comment, Open in v0 May 4, 2026 3:40pm
turbo-site Ready Ready Preview, Comment, Open in v0 May 4, 2026 3:40pm

@anthonyshew anthonyshew enabled auto-merge (squash) May 4, 2026 15:33
@anthonyshew anthonyshew disabled auto-merge May 4, 2026 15:35
@anthonyshew anthonyshew changed the title fix: Use full HMAC signatures for OG images fix: Harden OG image signatures May 4, 2026
@anthonyshew anthonyshew merged commit 76d26f8 into main May 4, 2026
36 checks passed
@anthonyshew anthonyshew deleted the anthonyshew/turbo-5453-deepsec-bug-hmac-truncated-to-64-bits-16-hex-chars branch May 4, 2026 15:43
anthonyshew pushed a commit that referenced this pull request May 4, 2026
## Release v2.9.9-canary.3

> [!CAUTION]
> Versioned docs aliasing FAILED. [View
logs](https://github.com/vercel/turborepo/actions/runs/25330303081)

### Changes

- release(turborepo): 2.9.9-canary.2 (#12708) (`7dacd56`)
- ci: Harden non-release GitHub Actions (#12707) (`4af1ef1`)
- docs: Add pnpm workspace flag (-w) to Oxc setup docs (#12655)
(`4e8a20f`)
- fix: Harden OG image signatures (#12709) (`76d26f8`)
- fix: Scope release npm publishing credentials (#12710) (`382f305`)
- ci: Harden release workflows (#12711) (`709c9d4`)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
anthonyshew added a commit that referenced this pull request May 4, 2026
## Release v2.9.9

> [!CAUTION]
> Versioned docs aliasing FAILED. [View
logs](https://github.com/vercel/turborepo/actions/runs/25342206497)

### Changes

- release(turborepo): 2.9.8 (#12700) (`09900b9`)
- fix: Remove Unix parent death watchdogs (#12699) (`22526bb`)
- release(turborepo): 2.9.9-canary.1 (#12705) (`72cc81c`)
- fix: Scope repo index prefixes to Git root (#12706) (`82dee40`)
- release(turborepo): 2.9.9-canary.2 (#12708) (`7dacd56`)
- ci: Harden non-release GitHub Actions (#12707) (`4af1ef1`)
- docs: Add pnpm workspace flag (-w) to Oxc setup docs (#12655)
(`4e8a20f`)
- fix: Harden OG image signatures (#12709) (`76d26f8`)
- fix: Scope release npm publishing credentials (#12710) (`382f305`)
- ci: Harden release workflows (#12711) (`709c9d4`)
- release(turborepo): 2.9.9-canary.3 (#12712) (`6f35176`)
- fix: Harden docs security endpoints (#12713) (`56eefcc`)
- ci: Harden internal GitHub Actions (#12714) (`cbe31ef`)
- ci: Harden release workflow handling (#12715) (`f89f3bd`)
- fix: Preserve lockfiles during dry-run conversion (#12717) (`3192551`)
- ci: Fix LSP workflow container matrix (#12718) (`ac55ec9`)

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Anthony Shew <anthonyshew@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant