s := base64.RawURLEncoding.EncodeToString([]byte(data))

b, err := base64.RawURLEncoding.DecodeString(s)

var Rando = rand.Reader
b := make([]byte, 16)
n, err := Rando.Read(b)
id := base64.RawURLEncoding.EncodeToString(b)

  func SafeRequest(req *http.Request) (*http.Response, error) {
    var netTransport = &http.Transport{
      Dial: (&net.Dialer{
        Timeout: 5 * time.Second,
      }).Dial,
      TLSHandshakeTimeout: 5 * time.Second,
    }
    var netClient = &http.Client{
      Timeout:   time.Second * 10,
      Transport: netTransport,
    }
    response, err := netClient.Do(req)
    if nil != err {
      return nil, err
    }
    body := response.Body
    response.Body = io.LimitReader(body, 1024 * 1024)
    //response.Body = MaxBytesReader(body, 1024*1024)
    return response, nil
  }

    srv := &http.Server{
        Addr:              runOpts.Addr,
        Handler:           r,
        ReadHeaderTimeout: 2 * time.Second,
        ReadTimeout:       10 * time.Second,
        WriteTimeout:      20 * time.Second,
        MaxHeaderBytes:    1024 * 1024, // 1MiB
    }
    if err := srv.ListenAndServe(); nil != err {
        fmt.Fprintf(os.Stderr, "%s", err)
        os.Exit(1)
        return
    }

var srv *httptest.Server

func TestMain(m *testing.M) {
    // math/rand.Seed(0)
    
    srv = httptest.NewServer(mux)
    os.Exit(m.Run())
}

  client := srv.Client()
  urlstr, _ := url.Parse(srv.URL + "/debug/verify?exp=false")

  req := &http.Request{
    Method: "POST",
    URL:    urlstr,
    //Body:   ioutil.NopCloser(bytes.NewReader(jws)),
    Header: http.Header{},
  }
  req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", jwt))
  res, err := client.Do(req)
  if nil != err {
    t.Error(err)
    return
  }
  data, err := ioutil.ReadAll(res.Body)
  if nil != err {
    t.Error(err)
    return
  }
  if 200 != res.StatusCode {
    log.Printf(string(data))
    t.Error(fmt.Errorf("bad status code: %d", res.StatusCode))
    return
  }

r.Body = http.MaxBytesReader(w, r.Body, 1 << 20)

import "crypto/subtle"

func ConstantTimeCompare(x, y []byte) bool {
  return 1 == subtle.ConstantTimeCompare(x, y)
}

const (
	// sha1Prefix is the prefix used by GitHub before the HMAC hexdigest.
	sha1Prefix = "sha1"
	// sha256Prefix and sha512Prefix are provided for future compatibility.
	sha256Prefix = "sha256"
	sha512Prefix = "sha512"
	// signatureHeader is the GitHub header key used to pass the HMAC hexdigest.
	signatureHeader = "X-Hub-Signature"
)

	if len(secretToken) > 0 {
		sig := r.Header.Get(signatureHeader)
		if err := ValidateSignature(sig, body, secretToken); err != nil {
			return nil, err
		}
	}
    
// ValidateSignature validates the signature for the given payload.
// signature is the GitHub hash signature delivered in the X-Hub-Signature header.
// payload is the JSON payload sent by GitHub Webhooks.
// secretToken is the GitHub Webhook secret token.
//
// GitHub API docs: https://developer.github.com/webhooks/securing/#validating-payloads-from-github
func ValidateSignature(signature string, payload, secretToken []byte) error {
	messageMAC, hashFunc, err := messageMAC(signature)
	if err != nil {
		return err
	}
	if !checkMAC(payload, messageMAC, secretToken, hashFunc) {
		return errors.New("payload signature check failed")
	}
	return nil
}

// checkMAC reports whether messageMAC is a valid HMAC tag for message.
func checkMAC(message, messageMAC, key []byte, hashFunc func() hash.Hash) bool {
	expectedMAC := genMAC(message, key, hashFunc)
	return hmac.Equal(messageMAC, expectedMAC)
}

// messageMAC returns the hex-decoded HMAC tag from the signature and its
// corresponding hash function.
func messageMAC(signature string) ([]byte, func() hash.Hash, error) {
	if signature == "" {
		return nil, nil, errors.New("missing signature")
	}
	sigParts := strings.SplitN(signature, "=", 2)
	if len(sigParts) != 2 {
		return nil, nil, fmt.Errorf("error parsing signature %q", signature)
	}

	var hashFunc func() hash.Hash
	switch sigParts[0] {
	case sha1Prefix:
		hashFunc = sha1.New
	case sha256Prefix:
		hashFunc = sha256.New
	case sha512Prefix:
		hashFunc = sha512.New
	default:
		return nil, nil, fmt.Errorf("unknown hash type prefix: %q", sigParts[0])
	}

	buf, err := hex.DecodeString(sigParts[1])
	if err != nil {
		return nil, nil, fmt.Errorf("error decoding signature %q: %v", signature, err)
	}
	return buf, hashFunc, nil
}