ci: security scanning, with the findings read and justified #17

Merged

marcos-mendez merged 1 commit from ci/security-scan into 19.x

2026-10-07 15:21:46 -03:00

marcos-mendez commented

2026-10-07 14:54:56 -03:00

(Migrated from github.com)

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit,
semgrep, shellcheck on hosted runners, no secrets) on pull requests,
pushes to 19.x and by hand. Not a required check.

Baseline from a scan of 19.x, none a risk. bandit B103 and semgrep's
insecure-file-permissions: 0o750 on the root-owned EC2 user-data
script, 0o700 on ~/.ssh. Plus 205 shellcheck warnings of existing
scripts (arrays in log messages, word splitting of build paths, unused
config variables), each justified in .github/security-baseline.
Eight Python 2 scripts under bin/ec2_legacy and contrib cannot be
parsed by bandit and are reported as warnings.

gitleaks: tests/layer writes truncated fake key headers on purpose and
tests/ec2-v19 named public key fingerprints, allowlisted by path in
.github/gitleaks.toml; BT_GPGKEY and GPGKEY are fingerprints of the
public TurnKey signing keys, ignored by fingerprint in
.github/.gitleaksignore.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to 19.x and by hand. Not a required check. Baseline from a scan of 19.x, none a risk. bandit B103 and semgrep's insecure-file-permissions: 0o750 on the root-owned EC2 user-data script, 0o700 on ~/.ssh. Plus 205 shellcheck warnings of existing scripts (arrays in log messages, word splitting of build paths, unused config variables), each justified in .github/security-baseline. Eight Python 2 scripts under bin/ec2_legacy and contrib cannot be parsed by bandit and are reported as warnings. gitleaks: tests/layer writes truncated fake key headers on purpose and tests/ec2-v19 named public key fingerprints, allowlisted by path in .github/gitleaks.toml; BT_GPGKEY and GPGKEY are fingerprints of the public TurnKey signing keys, ignored by fingerprint in .github/.gitleaksignore.