ci: security scanning, with the findings read and justified #12

Merged

marcos-mendez merged 1 commit from ci/security-scan into master

2026-10-07 15:39:00 -03:00

marcos-mendez commented

2026-10-07 14:57:29 -03:00

(Migrated from github.com)

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit,
semgrep, shellcheck on hosted runners, no secrets) on pull requests,
pushes to master and by hand. Not a required check.

Baseline from a scan of master, none a risk. B103 and semgrep's
insecure-file-permissions: 0755 on scripts that must run in the build
chroot. B324 and semgrep's MD5 rule: md5 keys a dict of comments, and
fills the MD5sum field of a local Packages index beside SHA256. Plus six
shellcheck warnings in share/initctl.dummy. gitleaks finds nothing.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to master and by hand. Not a required check. Baseline from a scan of master, none a risk. B103 and semgrep's insecure-file-permissions: 0755 on scripts that must run in the build chroot. B324 and semgrep's MD5 rule: md5 keys a dict of comments, and fills the MD5sum field of a local Packages index beside SHA256. Plus six shellcheck warnings in share/initctl.dummy. gitleaks finds nothing.