Validate GitHub signature in python

compare_digest.py

# validate github signature
import hashlib
import hmac
import json

signature = hmac.new(GITHUB_TOKEN, payload, hashlib.sha1).hexdigest()

# assuming that the 'payload' variable keeps the content sent by github as plain text
# and 'headers' variable keeps the headers sent by GitHub

if hmac.compare_digest(signature, headers['X-Hub-Signature'].split('=')[1]):

    payload_object = json.loads(payload)

    # do something here

    return json.dumps({'msg': 'Done!'})
else:
    return json.dumps({'msg': 'not a chance'})

If using flask service, just get the raw body as bytes (request.data), no need to do json.dumps or anything and encode the payload, or minify, it'll work.