ci: security scanning, with the findings read and justified #3

Merged

marcos-mendez merged 1 commit from ci/security-scan into master

2026-10-07 15:21:41 -03:00

marcos-mendez commented

2026-10-07 15:13:43 -03:00

(Migrated from github.com)

Baseline from a scan of master, none a risk. bandit B202 and B113 in
buildsrc_lib, the maintainer's import tool: the release tarball is
extracted only after its GPG signature is verified, and a missing
timeout can only hang a download. semgrep: two bash best-practice
hits in update-from-repo.sh. shellcheck: 86 warnings of upstream's
setup.sh, update scripts and maintainer scripts, each justified in
.github/security-baseline.

gitleaks finds 21 hits in the history, none live: minified xterm.js,
translation strings, RFC 6455's WebSocket GUID, a PEM header string
in nginx-lib.pl, and upstream's public default miniserv.pem, imported
with the 2.102 source and removed on 2026-08-24. Ignored by
fingerprint in .github/.gitleaksignore.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to master and by hand. Not a required check. semgrep's OSS rules have no Perl, so most of Webmin is covered by gitleaks only. Baseline from a scan of master, none a risk. bandit B202 and B113 in buildsrc_lib, the maintainer's import tool: the release tarball is extracted only after its GPG signature is verified, and a missing timeout can only hang a download. semgrep: two bash best-practice hits in update-from-repo.sh. shellcheck: 86 warnings of upstream's setup.sh, update scripts and maintainer scripts, each justified in .github/security-baseline. gitleaks finds 21 hits in the history, none live: minified xterm.js, translation strings, RFC 6455's WebSocket GUID, a PEM header string in nginx-lib.pl, and upstream's public default miniserv.pem, imported with the 2.102 source and removed on 2026-08-24. Ignored by fingerprint in .github/.gitleaksignore.