Add secret exception for trufflehog scan #13581
Conversation
jsquyres
left a comment
jsquyres
left a comment
There was a problem hiding this comment.
I confirm that a secret key exists in the libevent-2.1.12-stable.tar.gz tarball, in the test/regress_ssl.c file. Thanks for adding this trufflehog exception!
Do you need this exception file cherry-picked to any of the release branches? (v4.1.x, v5.0.x, v6.0.x) If so, feel free to make cherry-pick PRs.
|
There's something very odd about the branch on this PR -- it seems to be branched from a very, very old state of the Open MPI repository. The docs CI build is failing because it can't find the docs config files, for example. Can you base your branch off something much more recent / closer to the tip of this repository's |
celermajer
force-pushed
the
Add_secret_allowlist_for_trufflehog
branch
from
e40bd83 to
55c8c33
Compare
@jsquyres Thanks for the review! I've rebased the branch on the latest main to fix the CI issues. For the release branches - yes, I can create cherry-pick PRs for v4.1.x, v5.0.x, and v6.0.x once this is merged. |
.nspect-allowlist.toml
Outdated
| [[pulse-trufflehog.files.secrets]] | ||
| type = "PrivateKey" | ||
| values = [ "-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEAtK07Ili0dkJb79m/" ] |
There was a problem hiding this comment.
Nit: is there a reason this is indented and the previous entry is not?
There was a problem hiding this comment.
Good point! I removed the indentation
.nspect-allowlist.toml
Outdated
| [[pulse-trufflehog.files.secrets]] | ||
| type = "PrivateKey" | ||
| values = [ "-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEAtK07Ili0dkJb79m/" ] | ||
|
|
There was a problem hiding this comment.
Nit: blank line at end of file.
|
Hello! The Git Commit Checker CI bot found a few problems with this PR: aa18e69: .nspect-allowlist.toml remove useless blank line
Please fix these problems and, if necessary, force-push new commits back up to the PR branch. Thanks! |
|
Hello! The Git Commit Checker CI bot found a few problems with this PR: e53cd30: Fix formatting of secrets entry in allowlist
aa18e69: .nspect-allowlist.toml remove useless blank line
Please fix these problems and, if necessary, force-push new commits back up to the PR branch. Thanks! |
This PR adds an allowlist configuration to exclude a false positive detection of a test private key in the libevent library. The file is part of the libevent test suite and is not a real secret. Signed-off-by: Arnaud Celermajer <[email protected]>
janjust
force-pushed
the
Add_secret_allowlist_for_trufflehog
branch
from
e53cd30 to
710b3ff
Compare
3 participants
Add secret exception for security scan
This PR adds an allowlist configuration to exclude a false positive detection of a test private key in the libevent library.
Background
Security scanning tools may flag a test private key in
3rd-party/libevent-2.1.12-stable.tar.gz. This is a known false positive for the following reasons:test/regress_ssl.c)Changes
.nspect-allowlist.tomlconfiguration file