ci: security scanning, with the findings read and justified #32

Merged

marcos-mendez merged 1 commit from ci/security-scan into master

2026-10-07 15:20:09 -03:00

marcos-mendez commented

2026-10-07 14:47:45 -03:00

(Migrated from github.com)

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit,
semgrep, shellcheck on hosted runners, no secrets) on pull requests,
pushes to master and by hand. Not a required check.

Baseline from a scan of master, none a risk. bandit B605 and semgrep's
tainted-env rule on the same line: os.system of a constant shutdown
command, prefixed by chvt $FGVT from confconsole's own environment, a
root process. B104: WILDCARDS recognises a wildcard listen address, it
binds nothing. B113: a request with no timeout can only hang the
Let's Encrypt dialog. semgrep's insecure-file-permissions: only the
execute bits of two root-owned scripts are toggled. Plus 15 shellcheck
warnings of existing scripts.

gitleaks: the WireGuard keys of two test files are fixtures,
allowlisted by path in .github/gitleaks.toml.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to master and by hand. Not a required check. Baseline from a scan of master, none a risk. bandit B605 and semgrep's tainted-env rule on the same line: os.system of a constant shutdown command, prefixed by chvt $FGVT from confconsole's own environment, a root process. B104: WILDCARDS recognises a wildcard listen address, it binds nothing. B113: a request with no timeout can only hang the Let's Encrypt dialog. semgrep's insecure-file-permissions: only the execute bits of two root-owned scripts are toggled. Plus 15 shellcheck warnings of existing scripts. gitleaks: the WireGuard keys of two test files are fixtures, allowlisted by path in .github/gitleaks.toml.