 request = require 'request'
 async = require 'async'
 qs = require 'querystring'
+
+
+# Compute hash of payload to determine validity of response
+verify_signature = (payload, expected) ->
+  # signature invalid if one is present but the other isn't
+  return false if expected? != process.env.WEBHOOK_SECRET?
+  # only verify if both are present
+  return true unless expected?
+
+  actual = crypto
+    .createHmac 'sha1', process.env.WEBHOOK_SECRET
+    .update JSON.stringify(payload)
+    .digest 'hex'
+
+  return expected == "sha1=#{actual}"
 
 
 # return an array of strings

    return

  if not verify_signature req.body, req.headers['x-hub-signature']
    console.log 'Signatures invalid, continuing anyway YOLO'

  repo = req.body.repository.full_name
  q = { access_token: process.env.GITHUB_ACCESS_TOKEN }

    }, requestCb


postreceive = (req, res, next) ->
  # ping event
  if req.headers['x-github-event'] == 'ping'
