W2FM GitHub hook takeover

egoode commented

2026-05-04 15:15:13 +00:00

Description of request

Hi, I am trying to rotate the secret for the W2FM webhook on the rpm-software-management GitHub org, due to some notice from GitHub about a security issue on their end. However, I don't know which Fedora account owns the webhook and I suspect it may belong to someone no longer on the RPM/DNF team.

When I try to create a new webhook on the org, I get the error "Encountered "Error: 409: This service already exists" response during creation".

Is it possible to take over the webhook from whomever currently owns it? I would like to transfer ownership to the "rpmsoftwaremanagement" Fedora account. Knowing which Fedora user owns the webhook may be enough, and I can reach out to them.

Thanks!

### Description of request Hi, I am trying to rotate the secret for the W2FM webhook on the rpm-software-management GitHub org, due to some notice from GitHub about a security issue on their end. However, I don't know which Fedora account owns the webhook and I suspect it may belong to someone no longer on the RPM/DNF team. When I try to create a new webhook on the org, I get the error "Encountered "Error: 409: This service already exists" response during creation". Is it possible to take over the webhook from whomever currently owns it? I would like to transfer ownership to the "rpmsoftwaremanagement" Fedora account. Knowing which Fedora user owns the webhook may be enough, and I can reach out to them. Thanks!

smoliicek added the

labels

2026-05-04 19:11:22 +00:00

smoliicek commented

2026-05-04 19:11:39 +00:00

Member

CC: @abompard @t0xic0der

t0xic0der commented

2026-05-06 02:08:09 +00:00

Member

@egoode can you please provide use the username of the person that owns the webhook? That would help me purge the webhook bind from their account so that you could go ahead with creating one from the preferred account.

You could however create a webhook bind from the preferred account using a slightly different name because that is what we are making use of for the references. The purge still needs to happen for the GitHub webhook safety reasons.

@egoode can you please provide use the username of the person that owns the webhook? That would help me purge the webhook bind from their account so that you could go ahead with creating one from the preferred account. You could however create a webhook bind from the preferred account using a slightly different name because that is what we are making use of for the references. The purge still needs to happen for the GitHub webhook safety reasons.

t0xic0der self-assigned this

2026-05-06 02:08:10 +00:00

egoode commented

2026-05-11 13:25:04 +00:00

Author

That's the problem, I don't know who owns the rpm-software-management webhook.

t0xic0der commented

2026-05-12 05:49:17 +00:00

Member

@egoode oh well, could you at least delete the webhook entry from the rpm-software-management GitHub organization? I am not sure just how ideal this is but once you do that, you should be able to create a new entry.

Just use a different name for the webhook bind on the W2FM dashboard and you should be good to go. I would also suggest to attempt connecting with the folks contributing to the team to hunt down the webhook owner for safety.

@egoode oh well, could you at least delete the webhook entry from the rpm-software-management GitHub organization? I am not sure just how ideal this is but once you do that, you should be able to create a new entry. Just use a different name for the webhook bind on the W2FM dashboard and you should be good to go. I would also suggest to attempt connecting with the folks contributing to the team to hunt down the webhook owner for safety.

lsm5 commented

2026-05-12 19:52:25 +00:00

Hi, the container-tools team (maintainers of podman, buildah, skopeo upstream and Fedora packages) are also faced with the same issue. I suspect it's @mohanboddu that owns the webhooks setup for our org, but he's currently away on leave.

t0xic0der commented

2026-05-13 05:46:30 +00:00

Member

@lsm5 if @mohanboddu is temporarily on leave, you should not feel the need of taking it over from his hands now, do you? You could create a new webhook bind anyway with a different name and attach it to your GitHub organization or repository, though.

egoode commented

2026-05-15 20:54:12 +00:00

Author

Thanks @t0xic0der! Adding a new webhook with a different name worked.

The UI implies that the name of the webhook must match the repository name (or org name), so I didn't think to try this.

Thanks @t0xic0der! Adding a new webhook with a different name worked. The UI implies that the name of the webhook must match the repository name (or org name), so I didn't think to try this.

Screenshot from 2026-05-15 16-51-13.png

39 KiB

t0xic0der commented

2026-05-18 06:04:32 +00:00

Member

@egoode ahhh fair, that's on us. But hey, glad to know it worked. I am closing this as fixed.

Please feel free to create a new ticket if you need help and we would be glad to assist you.

@egoode ahhh fair, that's on us. But hey, glad to know it worked. I am closing this as fixed. Please feel free to create a new ticket if you need help and we would be glad to assist you.

t0xic0der closed this issue

2026-05-18 06:04:40 +00:00

Rows
Columns

W2FM GitHub hook takeover #13310

Description of request