search

cloud-gov / caulking

Prevent leaks with gitleaks, and use tests to validate
Other
32 stars 11 forks source link

Remove unused flag #70

Closed Sgtpluck closed 2 years ago

Sgtpluck commented 2 years ago

Previously, the gitleaks cmd used the --unstaged flag, which according to this issue no longer works in recent versions of gitleaks. (The unstaged flag is not documented on current versions of gitleaks at all.) Instead, users are encouraged to use gitleaks protect.

Changes proposed in this pull request:

security considerations

According to the above issue, gitleaks protect should work properly. (Although I am no expert, and would love another set of eyes/opinion on this!)

markdboyd commented 2 years ago

Thanks for the contribution! From what I can tell, the removal of the --unstaged is a breaking change in v8.0.0 of gitleaks . Thus, while these changes make caulking work for versions > v8 of gitleaks, I imagine that they would not work for versions < v8 of gitleaks.

I have not tested this assumption yet. But if it proves to be true, then this change would be breaking for people on < v8 of gitleaks.

If that is the case, then I think the easiest option would be to make v8 of gitleaks required for caulking, which means we would update our Makefile at a minimum.

I assume that you installed gitleaks directly via homebrew?

Sgtpluck commented 2 years ago

Hi! That assumption seems valid. I'm happy to either update the Makefile or do something else that might be useful for folks looking to solve this problem. (Troubleshooting documentation?)

markdboyd commented 2 years ago

@Sgtpluck I'd say updating the Makefile and noting in our README that gitleaks v8 is now required should be fine. That way anyone pulling down this repo fresh should be good to go.

Also, if you wouldn't mind running make audit to verify that everything works with your changes. Thanks!