diff --git a/.semgrepignore b/.semgrepignore new file mode 100644 index 000000000..0cd7ac550 --- /dev/null +++ b/.semgrepignore @@ -0,0 +1,47 @@ +# Paths that the OpenGrep SAST scan skips. The managed sast-scan workflow runs +# OpenGrep from the repository root, which reads this file. +# +# This file replaces the default ignore list of OpenGrep, so the first block +# repeats those defaults (OpenGrep 1.12.0, src/targeting/Semgrepignore.ml). + +# Administrative folder or file used by popular version control systems +.git +.svn +.hg +_darcs +CVS + +# Paths to files and folders that are typically large and ignorable +build/ +vendor/ +dist/ +*.min.js +.env/ +.tox/ + +# Package managers +node_modules/ +.npm/ +.yarn/ +.venv/ +_opam/ +_build/ +_cargo/ + +# Common test paths +test/ +tests/ +testsuite/ +*_test.go + +# End of the OpenGrep defaults. + +# Test data: test keys, sample reports with fake tokens, and test fixtures. +testdata/ + +# Development-only setup: development keys, Dex users and docs with example +# tokens. None of it is shipped. +devel/ + +# Documentation of the vendored Bitnami charts, also of nested chart dependencies. +deployment/chainloop/charts/**/README.md diff --git a/app/cli/internal/trace/e2e/claude.go b/app/cli/internal/trace/e2e/claude.go index 8cb01b0d9..4d8cadd18 100644 --- a/app/cli/internal/trace/e2e/claude.go +++ b/app/cli/internal/trace/e2e/claude.go @@ -54,7 +54,7 @@ func (c *Claude) TraceFlag() string { return "--claude" } // Version implements Harness. `claude --version` prints "2.1.0 (Claude Code)". func (c *Claude) Version(ctx context.Context) (string, error) { - out, err := exec.CommandContext(ctx, c.bin(), "--version").Output() //nolint:gosec // the harness binary under test + out, err := exec.CommandContext(ctx, c.bin(), "--version").Output() //nolint:gosec // the harness binary under test // nosemgrep if err != nil { return "", fmt.Errorf("claude --version: %w", err) } diff --git a/app/cli/internal/trace/e2e/opencode.go b/app/cli/internal/trace/e2e/opencode.go index 15550c09f..b8b72d508 100644 --- a/app/cli/internal/trace/e2e/opencode.go +++ b/app/cli/internal/trace/e2e/opencode.go @@ -71,7 +71,7 @@ func (o *OpenCode) TraceFlag() string { return "--opencode" } // An installed major version that is not the one of the column is an error, // because the cells would test the wrong column. func (o *OpenCode) Version(ctx context.Context) (string, error) { - out, err := exec.CommandContext(ctx, o.bin(), "--version").Output() //nolint:gosec // the harness binary under test + out, err := exec.CommandContext(ctx, o.bin(), "--version").Output() //nolint:gosec // the harness binary under test // nosemgrep if err != nil { return "", fmt.Errorf("opencode --version: %w", err) } diff --git a/app/cli/internal/trace/e2e/workspace.go b/app/cli/internal/trace/e2e/workspace.go index 4bba2a041..f9b4e53fb 100644 --- a/app/cli/internal/trace/e2e/workspace.go +++ b/app/cli/internal/trace/e2e/workspace.go @@ -173,7 +173,7 @@ func (w *Workspace) Git(ctx context.Context, args ...string) (string, error) { } func (w *Workspace) run(ctx context.Context, dir, name string, args ...string) (string, error) { - cmd := exec.CommandContext(ctx, name, args...) + cmd := exec.CommandContext(ctx, name, args...) //nolint:gosec // fixed commands of the e2e harness // nosemgrep cmd.Dir = dir cmd.Env = w.Env var stderr bytes.Buffer diff --git a/app/controlplane/plugins/plugins.go b/app/controlplane/plugins/plugins.go index a94e61e47..d4288fd6e 100644 --- a/app/controlplane/plugins/plugins.go +++ b/app/controlplane/plugins/plugins.go @@ -1,5 +1,5 @@ // -// Copyright 2023 The Chainloop Authors. +// Copyright 2023-2026 The Chainloop Authors. // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. @@ -195,7 +195,7 @@ func (i *goPluginInitializer) Init(path string) (*sdk.FanOutP, error) { client := plugin.NewClient(&plugin.ClientConfig{ HandshakeConfig: plugin_sdk.HandshakeConfig, Plugins: pluginSet, - Cmd: exec.Command(path), + Cmd: exec.Command(path), // path comes from plugin discovery in the operator-set plugins directory // nosemgrep AllowedProtocols: []plugin.Protocol{plugin.ProtocolGRPC}, AutoMTLS: true, }) diff --git a/deployment/chainloop/Chart.yaml b/deployment/chainloop/Chart.yaml index adab8d5c3..3115d7f67 100644 --- a/deployment/chainloop/Chart.yaml +++ b/deployment/chainloop/Chart.yaml @@ -7,7 +7,7 @@ description: Chainloop is an open source software supply chain control plane, a type: application # Bump the patch (not minor, not major) version on each change in the Chart Source code -version: 1.476.0 +version: 1.476.1 # Do not update appVersion, this is handled automatically by the release process appVersion: v1.128.1 diff --git a/deployment/chainloop/charts/dex/values.yaml b/deployment/chainloop/charts/dex/values.yaml index c0e3b3211..2974a8f1b 100644 --- a/deployment/chainloop/charts/dex/values.yaml +++ b/deployment/chainloop/charts/dex/values.yaml @@ -50,10 +50,10 @@ dex: staticUsers: - email: "john@chainloop.local" # password: "password" - hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" + hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" # development-only user # nosemgrep - email: "sarah@chainloop.local" # password: "password" - hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" + hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" # development-only user # nosemgrep ## @param dex.image.registry [default: REGISTRY_NAME] Dex image registry ## @param dex.image.repository [default: REPOSITORY_NAME/dex] Dex image repository ## @skip dex.image.tag Dex image tag (immutable tags are recommended) diff --git a/deployment/chainloop/templates/_helpers.tpl b/deployment/chainloop/templates/_helpers.tpl index e530766fd..a297125a3 100644 --- a/deployment/chainloop/templates/_helpers.tpl +++ b/deployment/chainloop/templates/_helpers.tpl @@ -40,7 +40,7 @@ DEVELOPMENT ONLY PRIVATE KEY NOTE: It can not be generated by HELM because we also need a public key */}} {{- define "chainloop.casjwt.private_key.devel" -}} ------BEGIN EC PRIVATE KEY----- +{{/* nosemgrep */}}-----BEGIN EC PRIVATE KEY----- MIHcAgEBBEIA762MbJK9IBnaqG0sd9uFRM+Z7Y+Aq5UfmbWf0+acKMYpYoy/8kBE tI6cpcA2KvmW5qurOjIMh5ISr+P2GmzSZX+gBwYFK4EEACOhgYkDgYYABAFzPMcM NUnPoC7b+s+/OyxRC7V/+elthj6Cq85WCj0KZ2qDvmd4QsYnsTIQ7NM7E+9WztdP