ci: security scanning, with the findings read and justified #2

Merged

marcos-mendez merged 1 commit from ci/security-scan into master

2026-10-07 15:20:23 -03:00

marcos-mendez commented

2026-10-07 14:53:04 -03:00

(Migrated from github.com)

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit,
semgrep, shellcheck on hosted runners, no secrets) on pull requests,
pushes to master and by hand. Not a required check.

Baseline from a scan of master, none a risk. bandit B605/B602 and
semgrep's tainted-env rules: executil's helpers run the caller's own
command with every argument quoted by mkarg, and paged, popen4 and
stdtrap run PAGER, SHELL or the caller's command as the invoking user.
setup.py runs a constant dpkg-parsechangelog. MD5 and SHA-1 name cache
entries, they are not security digests.

bandit cannot parse 22 of the 37 files, which are still Python 2; they
are scanned by semgrep only until the port. gitleaks finds nothing.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to master and by hand. Not a required check. Baseline from a scan of master, none a risk. bandit B605/B602 and semgrep's tainted-env rules: executil's helpers run the caller's own command with every argument quoted by mkarg, and paged, popen4 and stdtrap run PAGER, SHELL or the caller's command as the invoking user. setup.py runs a constant dpkg-parsechangelog. MD5 and SHA-1 name cache entries, they are not security digests. bandit cannot parse 22 of the 37 files, which are still Python 2; they are scanned by semgrep only until the port. gitleaks finds nothing.