ci: security scanning, with the findings read and justified #2

Merged

marcos-mendez merged 1 commit from ci/security-scan into keel/trixie

2026-10-07 15:21:33 -03:00

marcos-mendez commented

2026-10-07 14:53:33 -03:00

(Migrated from github.com)

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit,
semgrep, shellcheck on hosted runners, no secrets) on pull requests,
pushes to keel/trixie and by hand. Not a required check.

A scan of keel/trixie finds no Python, nothing for semgrep or
shellcheck, so there is no baseline.

gitleaks finds TurnKey's placeholder certificate and key (CN=tkldev,
2015, expired) in the history: copied from common's sslcert overlay on
2023-06-08 and removed the next day, public upstream for a decade, and
every appliance makes its own key at first boot. Ignored by fingerprint
in .github/.gitleaksignore.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to keel/trixie and by hand. Not a required check. A scan of keel/trixie finds no Python, nothing for semgrep or shellcheck, so there is no baseline. gitleaks finds TurnKey's placeholder certificate and key (CN=tkldev, 2015, expired) in the history: copied from common's sslcert overlay on 2023-06-08 and removed the next day, public upstream for a decade, and every appliance makes its own key at first boot. Ignored by fingerprint in .github/.gitleaksignore.