[Trufflehog Update] Deprecation of GitGuardian and mandatory update to Trufflehog #86
Comments
|
I have runned a scan eclipse-tractusx/sig-infra#545 for checking which repos have the Trufflehog and which ones not: List of Repositories that do not contain Trufflehog (archived are excluded): Since the gitguardian do not needed a worflow but was there by the default, now we need to include the workflows in order to keep the secret scanning functionality. |
|
fyi: secret scanning and secret scanning push protection is already enabled for all repos in the eclipse-tractusx organization and currently all committers are setup as security managers so can access information in the security tab of the organization / repo to access whether any secrets have been detected (push protection is not able to prevent all secrets from being pushed). So thats a good start, having a second way to do secret scanning is certainly a good idea. However, may I suggest that you add the template e.g. to the sig-security repo so that the other repos just have to call that workflow instead of copy & pasting the whole workflow again and again? This would be similar to how the mavenLicenseCheck.yml is setup as you can see here: https://github.com/eclipse-dash/dash-licenses/blob/master/.github/workflows/mavenLicenseCheck.yml That way you can adjust that easily in one place without having to check it for every repo if something has to change. Also I would suggest to pin the action to a specific version and update as needed. |
|
btw the overview here https://entro.security/blog/securing-the-code-navigating-code-and-github-secrets-scanning/ does not talk so well about trufflehog due to its high number of false positives, but I guess you did some research beforehand, I actually never used that tool. |
|
Hi @netomi, thank you for your support 💯 The Trufflehog tool was selected by our security experts as the preferred open source security scan tool to substitute GitGuardian. Happy to know that we have enabled by default the secret scanning from the GitHub side! The reason we are using an additional scan is to double check in the PRs if there is any secret there. I am aware it can raise several false positives, but the same was happening with GitGuardian if I am honest... I will bring this topic and your comments in our next office hour and committer meeting. |
|
@eclipse-tractusx/automotive-tractusx-committers remember to add the Trufflehog commit We should also discuss in the committer round which repos do not need the workflow at all :) |
|
its fine for me to use that additional secret scanning tool. I am wondering a bit how potentially detected secrets are reported. In the workflow log? Also the .eclipsefdn would ideally be exempted from that workflow. We do get notifications if the GitHub secret scanning detects some though and that should be enough for now afaict. |
|
@netomi they should ideally be reported in the security tab when run in main, and if run in a PR in the workflow I suppose. Sure I believe we also don't need in other repos like .github or other ones as you mentioned, we will close the issues from the repos that do not require the double secrets scanning check :) |
|
We need to add the --only-verified and add the workflow in the .github. |
|
Update TRG |
|
Ticket open in eclipse help desk to deprecate the gitguardian: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/5281 |
|
Gitguardian is desactivated... Please integrate the trufflehog as soon as posible, if secrets are leaked is in your own risk now. ☠️ Thank you very much for everyone that has added the trufflehog workflow! 🎉 💯 @eclipse-tractusx/automotive-tractusx-committers please note that is recommended to use the This Repos still not have it, they are added to the list of candidates to be deprecated: 📛
Please note that I have added the workflow in .github: https://github.com/eclipse-tractusx/.github/blob/main/.github/workflows/trufflehog.yaml |
|
I am closing this issue then! Great Job everyone! |
github-project-automation
bot
moved this from In Progress
to Done
in Tractus-X Open Meetings
Description
The GitGuardian secret scanning tool licence is now going to be expired, therefore in order to maintain the Security of the Tractus-X Repositories there will be inforced the TRG-8.03 for all Tractus-X repos.
In order to keep the secret scanning functionality, it is required to add a workflow, so that before PRs are merged, there will be scanned for any API secrets, passwords, etc. Preventing you to publish into the open source repo
mainbranch important secrets.Why?
TruffleHog is an open source tool designed to identify sensitive information, such as API keys, passwords, and other credentials, that may have been inadvertently committed to your code repository. This tool is expected to be used in parallel to the native GitHub Secret Scanning tool.
Goal
TRG 8.03
Detecting and removing these secrets is crucial for maintaining the security of your application and infrastructure. TruffleHog performs a thorough search by checking the entire repository history, not just the latest commits. This means it can find secrets that were committed in the past and might still pose a security risk.
Configure your GitHub Actions to include:
workflow dispatch: Manual workflow execution.
schedule: Schedule the workflow to run at least once a week with 0 0 * * 0.
push and pull_request: Activate the workflow on both push and pull request events targeting the branch that contains the code for the currently supported version, which may not necessarily be the main branch. This is the branch from which new releases will be made.
Note: extra_args:
--filter-entropy=4 --results=verified,unknownIncluding extra_args:
--filter-entropy=4 --results=verified,unknownin the GitHub Actions workflow ensures that TruffleHog focuses on detecting high-entropy strings, which are more likely to be sensitive information such as passwords or API keys. This setup also instructs TruffleHog to report both verified secrets and potential but unverified secrets, providing a comprehensive security scan that helps identify and address all possible vulnerabilities in the code.Including
run: exit 1in a step of a GitHub Actions workflow, as demonstrated below, commands the workflow to halt execution. This ensures that should TruffleHog uncover any secrets during its scan, the workflow promptly terminates in failure.GitHub Actions allows you to define workflows to automatically run TruffleHog scans on your code. You'll see the output that triggered the failure directly in the logs.
Here’s how you can set it up:
I have runned a scan eclipse-tractusx/sig-infra#545 for checking which repos have the Trufflehog and which ones not:
List of Repositories that do not contain Trufflehog (archived are excluded):
Since the gitguardian do not needed a worflow but was there by the default, now we need to include the workflows in order to keep the secret scanning functionality.
The text was updated successfully, but these errors were encountered: