PGP armor encrypted multiline yaml blocks reporting false positives, unable to exclude with pragma or regex

[benfiedler]

• I'm submitting a ...

  • [ ] bug report
  • [x] feature request

• What is the current behavior? When using detect-secrets in a repository containing yaml with PGP armor'ed multiline message blocks, each individual line underneath BEGIN PGP MESSAGE is reported as a Base64 High Entropy String.

• If the current behavior is a bug, please provide the steps to reproduce and if possible a minimal demo of the problem

somefile.yaml:

myapp:
  user: smith
  secured_credential: |
    -----BEGIN PGP MESSAGE-----
    mQGNBF2lnPIBDAC5cL9PQoQLTMuhjbYvb4Ncuuo0bfmgPRFywX53jPhoFf4Zg6mv
    /seOXpgecTdOcVttfzC8ycIKrt3aQTiwOG/ctaR4Bk/t6ayNFfdUNxHWk4WCKzdz
    /56fW2O0F23qIRd8UUJp5IIlN4RDdRCtdhVQIAuzvp2oVy/LaS2kxQoKvph/5pQ/
    5whqsyroEWDJoSV0yOb25B/iwk/pLUFoyhDG9bj0kIzDxrEqW+7Ba8nocQlecMF3
    -----END PGP MESSAGE-----
 another_setting: true

# pragma: nextline secret does not seem sufficient for overriding this.

Here are a few different exclude regexes I have tried in my .pre-commit-config.yaml without success:

  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      -   id: detect-secrets
          name: Detect secrets
          entry: detect-secrets-hook
          # args: ['--exclude-secrets', '\-{5}BEGIN PGP MESSAGE\-{5}[\s\S]+?\-{5}END PGP MESSAGE\-{5}$']
          # args: ['--exclude-secrets', '\-{5}BEGIN PGP MESSAGE\-{5}']
          # args: ['--exclude-secrets', '"\-{5}BEGIN PGP MESSAGE\-{5}[\s\S]+?\-{5}END PGP MESSAGE\-{5}$"']
          # args: ['--exclude-secrets', '"\-{5}BEGIN PGP MESSAGE\-{5}"']

• What is the expected behavior? I would think either multiline encrypted PGP Messages should be parsed and automatically permitted, or I should be able to exclude the entire block.

• What is the motivation / use case for changing the behavior? Permit multiline YAML PGP secrets without excluding the entire file, or without each line being considered a secret.

• Please tell us about your environment:

  • detect-secrets Version: v1.4.0
  • Python Version: 3.9.2
  • OS Version: Debian 11 bullseye
  • File type (if applicable): yaml

• Other information