Documentation
¶
Overview ¶
Package githubtoken identifies and validates a GitHub authentication token — the prefixed, checksummed formats GitHub adopted in April 2021 (ghp_, gho_, ghu_, ghs_, ghr_, github_pat_). A leaked GitHub token is the single most common secret found in repos, dumps, logs, and CI configs, and the format carries a **CRC32 checksum** that lets a finder confirm offline whether a captured string is a **genuine, well-formed token** (vs. a redaction, a typo, or a fabricated lookalike) — a positive secret-scanning detection from the token alone, with no API call to GitHub. Pure offline transform; no network or device.
Wrap-vs-native judgement ¶
Native. A GitHub token is `<prefix><30-char base62 entropy><6-char base62 CRC32 checksum>`; validation is a CRC32 (stdlib hash/crc32) of the entropy compared to the base62-decoded checksum. A hash + a base conversion, stdlib only — nothing to wrap.
What this covers / defers ¶
- The five classic token types (ghp_ / gho_ / ghu_ / ghs_ / ghr_) get full prefix identification + CRC32 checksum validation (the entropy is the part after the prefix, excluding the trailing 6 checksum characters).
- Fine-grained PATs (github_pat_) are identified by prefix but their internal structure differs (an embedded underscore) and is not vector- verified here, so the checksum is **not asserted** for them.
- Legacy 40-hex tokens (pre-April-2021) carry no prefix or checksum and are indistinguishable from any other 40-hex string, so they are not claimed.
Verifiable / no confidently-wrong output ¶
Anchored to the canonical example token (prefix ghp_, entropy zQWBuTSOoRi4A9spHcVY5ncnsDkxkJ, checksum 0mLq17): the entropy's CRC32 (714468973) equals the base62-decoded checksum — confirming both the algorithm and the vector. A token whose checksum does not validate is reported as such (likely a typo / redaction / fake), not asserted genuine; a non-recognised prefix is rejected.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Result ¶
type Result struct {
// Type is the human description of the token kind.
Type string `json:"type"`
// Prefix is the recognised token prefix.
Prefix string `json:"prefix"`
// ChecksumChecked is true when this token type's CRC32 checksum was validated.
ChecksumChecked bool `json:"checksum_checked"`
// ChecksumValid is the result of that validation (meaningful only when
// ChecksumChecked).
ChecksumValid bool `json:"checksum_valid"`
// Note carries the validity verdict or a caveat.
Note string `json:"note,omitempty"`
}
Result is the decoded view of a GitHub token.
Source Files