From bf75c2cc2b617a4cce3bb125c74e6a6f27d1b871 Mon Sep 17 00:00:00 2001 From: "Jose I. Paris" Date: Wed, 28 Oct 2026 16:21:51 +0100 Subject: [PATCH 1/2] chore: skip test data and dev-only files in the OpenGrep scan The managed SAST scan reported test keys, sample reports with fake tokens, the development keys and Dex users, vendored chart docs, and exec calls whose input does not come from users. Add a .semgrepignore for test data, devel/ and the vendored chart READMEs. It repeats the default ignore list of OpenGrep, which the file replaces. Mark the remaining false positives with nosemgrep: the development CAS key and Dex users of the chart, the plugin loader, and the e2e harness. The rendered chart does not change. Refs: PFM-8051 Assisted-by: Claude Code Signed-off-by: Jose I. Paris Chainloop-Trace-Sessions: 6ef5e9f5-dc0c-45cf-8b3f-70d112a87b7e --- .semgrepignore | 30 +++++++++++++++++++++ app/cli/internal/trace/e2e/claude.go | 2 +- app/cli/internal/trace/e2e/opencode.go | 2 +- app/cli/internal/trace/e2e/workspace.go | 2 +- app/controlplane/plugins/plugins.go | 4 +-- deployment/chainloop/Chart.yaml | 2 +- deployment/chainloop/charts/dex/values.yaml | 4 +-- deployment/chainloop/templates/_helpers.tpl | 2 +- 8 files changed, 39 insertions(+), 9 deletions(-) create mode 100644 .semgrepignore diff --git a/.semgrepignore b/.semgrepignore new file mode 100644 index 000000000..74fb53b4f --- /dev/null +++ b/.semgrepignore @@ -0,0 +1,30 @@ +# Paths that the OpenGrep SAST scan skips. The managed sast-scan workflow runs +# OpenGrep from the repository root, which reads this file. +# +# This file replaces the default ignore list of OpenGrep, so the first block +# repeats those defaults. +node_modules/ +build/ +dist/ +vendor/ +.env/ +.venv/ +.tox/ +*.min.js +.npm/ +.yarn/ +test/ +tests/ +*_test.go +.semgrep +.semgrep_logs/ + +# Test data: test keys, sample reports with fake tokens, and test fixtures. +testdata/ + +# Development-only setup: development keys, Dex users and docs with example +# tokens. None of it is shipped. +devel/ + +# Documentation of the vendored Bitnami charts. +deployment/chainloop/charts/*/README.md diff --git a/app/cli/internal/trace/e2e/claude.go b/app/cli/internal/trace/e2e/claude.go index 8cb01b0d9..4d8cadd18 100644 --- a/app/cli/internal/trace/e2e/claude.go +++ b/app/cli/internal/trace/e2e/claude.go @@ -54,7 +54,7 @@ func (c *Claude) TraceFlag() string { return "--claude" } // Version implements Harness. `claude --version` prints "2.1.0 (Claude Code)". func (c *Claude) Version(ctx context.Context) (string, error) { - out, err := exec.CommandContext(ctx, c.bin(), "--version").Output() //nolint:gosec // the harness binary under test + out, err := exec.CommandContext(ctx, c.bin(), "--version").Output() //nolint:gosec // the harness binary under test // nosemgrep if err != nil { return "", fmt.Errorf("claude --version: %w", err) } diff --git a/app/cli/internal/trace/e2e/opencode.go b/app/cli/internal/trace/e2e/opencode.go index 15550c09f..b8b72d508 100644 --- a/app/cli/internal/trace/e2e/opencode.go +++ b/app/cli/internal/trace/e2e/opencode.go @@ -71,7 +71,7 @@ func (o *OpenCode) TraceFlag() string { return "--opencode" } // An installed major version that is not the one of the column is an error, // because the cells would test the wrong column. func (o *OpenCode) Version(ctx context.Context) (string, error) { - out, err := exec.CommandContext(ctx, o.bin(), "--version").Output() //nolint:gosec // the harness binary under test + out, err := exec.CommandContext(ctx, o.bin(), "--version").Output() //nolint:gosec // the harness binary under test // nosemgrep if err != nil { return "", fmt.Errorf("opencode --version: %w", err) } diff --git a/app/cli/internal/trace/e2e/workspace.go b/app/cli/internal/trace/e2e/workspace.go index 4bba2a041..f9b4e53fb 100644 --- a/app/cli/internal/trace/e2e/workspace.go +++ b/app/cli/internal/trace/e2e/workspace.go @@ -173,7 +173,7 @@ func (w *Workspace) Git(ctx context.Context, args ...string) (string, error) { } func (w *Workspace) run(ctx context.Context, dir, name string, args ...string) (string, error) { - cmd := exec.CommandContext(ctx, name, args...) + cmd := exec.CommandContext(ctx, name, args...) //nolint:gosec // fixed commands of the e2e harness // nosemgrep cmd.Dir = dir cmd.Env = w.Env var stderr bytes.Buffer diff --git a/app/controlplane/plugins/plugins.go b/app/controlplane/plugins/plugins.go index a94e61e47..d4288fd6e 100644 --- a/app/controlplane/plugins/plugins.go +++ b/app/controlplane/plugins/plugins.go @@ -1,5 +1,5 @@ // -// Copyright 2023 The Chainloop Authors. +// Copyright 2023-2026 The Chainloop Authors. // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. @@ -195,7 +195,7 @@ func (i *goPluginInitializer) Init(path string) (*sdk.FanOutP, error) { client := plugin.NewClient(&plugin.ClientConfig{ HandshakeConfig: plugin_sdk.HandshakeConfig, Plugins: pluginSet, - Cmd: exec.Command(path), + Cmd: exec.Command(path), // path comes from plugin discovery in the operator-set plugins directory // nosemgrep AllowedProtocols: []plugin.Protocol{plugin.ProtocolGRPC}, AutoMTLS: true, }) diff --git a/deployment/chainloop/Chart.yaml b/deployment/chainloop/Chart.yaml index adab8d5c3..3115d7f67 100644 --- a/deployment/chainloop/Chart.yaml +++ b/deployment/chainloop/Chart.yaml @@ -7,7 +7,7 @@ description: Chainloop is an open source software supply chain control plane, a type: application # Bump the patch (not minor, not major) version on each change in the Chart Source code -version: 1.476.0 +version: 1.476.1 # Do not update appVersion, this is handled automatically by the release process appVersion: v1.128.1 diff --git a/deployment/chainloop/charts/dex/values.yaml b/deployment/chainloop/charts/dex/values.yaml index c0e3b3211..2974a8f1b 100644 --- a/deployment/chainloop/charts/dex/values.yaml +++ b/deployment/chainloop/charts/dex/values.yaml @@ -50,10 +50,10 @@ dex: staticUsers: - email: "john@chainloop.local" # password: "password" - hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" + hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" # development-only user # nosemgrep - email: "sarah@chainloop.local" # password: "password" - hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" + hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" # development-only user # nosemgrep ## @param dex.image.registry [default: REGISTRY_NAME] Dex image registry ## @param dex.image.repository [default: REPOSITORY_NAME/dex] Dex image repository ## @skip dex.image.tag Dex image tag (immutable tags are recommended) diff --git a/deployment/chainloop/templates/_helpers.tpl b/deployment/chainloop/templates/_helpers.tpl index e530766fd..a297125a3 100644 --- a/deployment/chainloop/templates/_helpers.tpl +++ b/deployment/chainloop/templates/_helpers.tpl @@ -40,7 +40,7 @@ DEVELOPMENT ONLY PRIVATE KEY NOTE: It can not be generated by HELM because we also need a public key */}} {{- define "chainloop.casjwt.private_key.devel" -}} ------BEGIN EC PRIVATE KEY----- +{{/* nosemgrep */}}-----BEGIN EC PRIVATE KEY----- MIHcAgEBBEIA762MbJK9IBnaqG0sd9uFRM+Z7Y+Aq5UfmbWf0+acKMYpYoy/8kBE tI6cpcA2KvmW5qurOjIMh5ISr+P2GmzSZX+gBwYFK4EEACOhgYkDgYYABAFzPMcM NUnPoC7b+s+/OyxRC7V/+elthj6Cq85WCj0KZ2qDvmd4QsYnsTIQ7NM7E+9WztdP From 4a1e6b0fc860a1951792498e16da2bea0344d9fe Mon Sep 17 00:00:00 2001 From: "Jose I. Paris" Date: Wed, 28 Oct 2026 17:04:40 +0100 Subject: [PATCH 2/2] chore: repeat the full OpenGrep default ignore list The list in .semgrepignore missed some OpenGrep defaults (version control folders, testsuite/, _opam/, _build/, _cargo/), so a scan with the file read paths that a scan without it skips. Copy the defaults of OpenGrep 1.12.0 exactly, and match the README files of nested chart dependencies with a recursive pattern. Refs: PFM-8051 Assisted-by: Claude Code Signed-off-by: Jose I. Paris Chainloop-Trace-Sessions: 6ef5e9f5-dc0c-45cf-8b3f-70d112a87b7e --- .semgrepignore | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-) diff --git a/.semgrepignore b/.semgrepignore index 74fb53b4f..0cd7ac550 100644 --- a/.semgrepignore +++ b/.semgrepignore @@ -2,22 +2,39 @@ # OpenGrep from the repository root, which reads this file. # # This file replaces the default ignore list of OpenGrep, so the first block -# repeats those defaults. -node_modules/ +# repeats those defaults (OpenGrep 1.12.0, src/targeting/Semgrepignore.ml). + +# Administrative folder or file used by popular version control systems +.git +.svn +.hg +_darcs +CVS + +# Paths to files and folders that are typically large and ignorable build/ -dist/ vendor/ +dist/ +*.min.js .env/ -.venv/ .tox/ -*.min.js + +# Package managers +node_modules/ .npm/ .yarn/ +.venv/ +_opam/ +_build/ +_cargo/ + +# Common test paths test/ tests/ +testsuite/ *_test.go -.semgrep -.semgrep_logs/ + +# End of the OpenGrep defaults. # Test data: test keys, sample reports with fake tokens, and test fixtures. testdata/ @@ -26,5 +43,5 @@ testdata/ # tokens. None of it is shipped. devel/ -# Documentation of the vendored Bitnami charts. -deployment/chainloop/charts/*/README.md +# Documentation of the vendored Bitnami charts, also of nested chart dependencies. +deployment/chainloop/charts/**/README.md