From a4564708a8fab257bf3fbe793c27888f21f25187 Mon Sep 17 00:00:00 2001 From: James Foster Date: Tue, 20 Oct 2026 21:33:09 -0700 Subject: [PATCH] Follow the two password-literal allowlists to where 1.9.0's pins moved them The 1.9.0 release stopped at the secret scan: 9 hits per package, all from gemstone-password-literal, all text the allowlists already cover under paths the pin bumps moved. Grail #1716 moved the third-party packages it bundles, Django among them, from src/python/stdlib/ to src/python/bundled/ (7 hits: Django's password1_field_name="password1" and PASSWORD_FIELD = "password"). mcp_server 0.9.0 (#57) became a Rowan project, so its auth tests are now the Tonel package src/Mcp-Auth-Tests/ (2 hits: the throwaway user's 'swordfishXYZ'), which --no-auth still leaves out of the database with the rest of the Auth component. Run with gitleaks 8.30.1 over the 1.9.0 packages CI built for 58f85e3, main's config finds those 9 in each package and this one finds none. Co-Authored-By: Claude Opus 5.5 --- .gitleaks.toml | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/.gitleaks.toml b/.gitleaks.toml index 3ed148f..e6bfe16 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -76,15 +76,21 @@ tags = ["password", "open-vsx"] # `KEY_PASSWORD = "somepass"`, `load_cert_chain(..., password="badpass")` — # identical in every CPython and Django distribution and not GemDB's to change. # -# Scoped to this one custom rule and to that one directory, so a real key +# Scoped to this one custom rule and to those directories, so a real key # planted in the stdlib tree is still caught by `private-key` and everything # else the defaults bring. Deliberately NOT allowlisted by secret text: the # literals are ordinary words, and matching on them would suppress the same # words anywhere in the package. +# +# Two directories since Grail #1716 (pinned for 1.9.0), which moved the +# third-party packages Grail ships -- Django among them -- out of stdlib/ into +# src/python/bundled/. The same Django lines then failed the 1.9.0 release +# scan from the new path, 7 hits per package (`password1_field_name= +# "password1"`, `PASSWORD_FIELD = "password"`), with nothing new in them. [[allowlists]] -description = "Password field names and test fixtures in the bundled CPython/Django standard library" +description = "Password field names and test fixtures in the bundled CPython standard library and third-party packages" targetRules = ["gemstone-password-literal"] -paths = ['''grail/src/python/stdlib/'''] +paths = ['''grail/src/python/stdlib/''', '''grail/src/python/bundled/'''] # The MCP server's own auth tests, which create a throwaway user: # `AllUsers addNewUserWithId: aUserId password: 'swordfishXYZ'`. Upstream test @@ -100,10 +106,16 @@ paths = ['''grail/src/python/stdlib/'''] # different change with a different argument, and it would put `--auth` out of # reach of anyone who later makes it startable. Scoped to that one directory and # this one rule, so the defaults still apply there in full. +# +# The directory moved with mcp_server 0.9.0 (#57, pinned for 1.9.0), which +# became a Rowan project: the auth tests are now the Tonel package +# src/Mcp-Auth-Tests/, and the same fixture failed the 1.9.0 release scan +# there, twice per package. With `--no-auth` the Rowan load leaves the Auth +# component, and its tests, out of the database just as the file-in did. [[allowlists]] -description = "Test-fixture credentials in the MCP server's auth tests, which GemDB files in with --no-auth" +description = "Test-fixture credentials in the MCP server's auth tests, which GemDB loads with --no-auth" targetRules = ["gemstone-password-literal"] -paths = ['''mcp/src/auth/'''] +paths = ['''mcp/src/Mcp-Auth-Tests/'''] # --------------------------------------------------------------------------- # GemDB's own telemetry endpoint