From 9d8dbd9712999a99c607e289ecdd92138e42a446 Mon Sep 17 00:00:00 2001 From: Gerrrt Date: Tue, 18 Aug 2026 15:46:24 -0700 Subject: [PATCH] chore(ci): list both fingerprint forms so .gitleaksignore works on any gitleaks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `make validate` failed on the developer machine and passed in CI, for nine findings this file already documents: FAIL gitleaks (full history) leaks found: 9 A gitleaks fingerprint is `:::`, matched as a literal string. Up to and including v8.25 the commit is the full 40-char SHA; from v8.26 it is the 7-char short form. Path, rule and line are byte-identical across the change — only the SHA length moved: in this file (written by 8.24.0) ee3d443abc19029f182edbcf9beadb3e6ca8f7c5:…:4 emitted by a local 8.30.1 ee3d443:…:4 CI pins zricethezav/gitleaks:v8.24.0 while `brew install gitleaks` is years ahead of that, so one form can only ever satisfy one of the two. That is the precise failure this file was written to prevent. Its own header says a scan "that is red for a known reason gets ignored, and then a *new* leak goes unnoticed too" — and a permanently red `make validate` trains exactly that habit, on the machine where the developer is most likely to introduce a leak. List both forms. An entry matching no finding is inert, so the full-SHA lines stay correct for CI and the short-SHA lines cover anything 8.26+. This also removes the need to touch the file again the next time the format moves; a third form can just be appended. Not pinned locally instead, because that fixes one machine and a `brew upgrade` silently undoes it. Not regenerated for 8.26+, because that would invert the problem and break CI. Verified with the local 8.30.1: `gitleaks --log-opts=--all` reports 0, and `./scripts/validate.sh` reports `all checks passed`. Confirmed still able to catch a new leak — a decoy private key dropped in the working tree is detected, so the additions are not over-broad. The full-SHA half is exercised by CI on this PR. After the history purge this whole file goes away and the duplication with it. Co-Authored-By: Claude Opus 5 --- .gitleaksignore | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/.gitleaksignore b/.gitleaksignore index f0f56d1..82998d4 100644 --- a/.gitleaksignore +++ b/.gitleaksignore @@ -12,22 +12,40 @@ # # After the history purge these fingerprints become stale and this file should # be deleted. If gitleaks then reports nothing, the job is finished. +# +# Each finding is listed twice: gitleaks <=8.25 writes the full 40-char commit +# SHA into a fingerprint, 8.26+ writes the 7-char short form, and a fingerprint +# is matched as a literal string. CI pins v8.24.0 (see GITLEAKS_IMAGE in +# .github/workflows/ci.yml) while a local `brew install gitleaks` is far newer, +# so a single form makes `make validate` red on the developer machine and green +# in CI, for nine findings that are already known. A red gate for a known reason +# is the exact failure this file exists to prevent. Listing both forms costs +# nothing: an entry that matches no finding is inert. # --- Shared SNMP community string, committed in plaintext (commit ee3d443) --- # One string reused across pfSense, the APC UPS, the MokerLink switch and iLO. ee3d443abc19029f182edbcf9beadb3e6ca8f7c5:snmp-exporter/prometheus.matrix.elysium/config/snmp.yaml:snmp-community-plaintext:4 +ee3d443:snmp-exporter/prometheus.matrix.elysium/config/snmp.yaml:snmp-community-plaintext:4 ee3d443abc19029f182edbcf9beadb3e6ca8f7c5:snmp-exporter/prometheus.matrix.elysium/config/snmp.yaml:snmp-community-plaintext:10 +ee3d443:snmp-exporter/prometheus.matrix.elysium/config/snmp.yaml:snmp-community-plaintext:10 ee3d443abc19029f182edbcf9beadb3e6ca8f7c5:snmp-exporter/prometheus.matrix.elysium/config/snmp.yaml:snmp-community-plaintext:16 +ee3d443:snmp-exporter/prometheus.matrix.elysium/config/snmp.yaml:snmp-community-plaintext:16 ee3d443abc19029f182edbcf9beadb3e6ca8f7c5:snmp-exporter/prometheus.matrix.elysium/config/snmp.yaml:snmp-community-plaintext:22 +ee3d443:snmp-exporter/prometheus.matrix.elysium/config/snmp.yaml:snmp-community-plaintext:22 # --- Grafana admin password inline in the compose file (commit ee3d443) --- # admin/admin, alongside GF_AUTH_ANONYMOUS_ENABLED=true with Admin role. ee3d443abc19029f182edbcf9beadb3e6ca8f7c5:grafana/prometheus.matrix.elysium/docker-compose.yaml:grafana-inline-password:7 +ee3d443:grafana/prometheus.matrix.elysium/docker-compose.yaml:grafana-inline-password:7 # --- TLS private keys (introduced efb2632, deleted in 647d90a) --- # Passphrase-encrypted, which mitigates but does not resolve. Still recoverable # with `git show 647d90a~1:certificates/Gandalf.Gondor.Lab/ca-key.pem`. efb263225de6ee4961421596fd43e3f69b3bce8f:certificates/Gandalf.Gondor.Lab/ca-key.pem:private-key:1 +efb2632:certificates/Gandalf.Gondor.Lab/ca-key.pem:private-key:1 efb263225de6ee4961421596fd43e3f69b3bce8f:certificates/Gandalf.Gondor.Lab/ca-key.pem:private-key-block:1 +efb2632:certificates/Gandalf.Gondor.Lab/ca-key.pem:private-key-block:1 efb263225de6ee4961421596fd43e3f69b3bce8f:certificates/Gandalf.Gondor.Lab/cert-key.pem:private-key:1 +efb2632:certificates/Gandalf.Gondor.Lab/cert-key.pem:private-key:1 efb263225de6ee4961421596fd43e3f69b3bce8f:certificates/Gandalf.Gondor.Lab/cert-key.pem:private-key-block:1 +efb2632:certificates/Gandalf.Gondor.Lab/cert-key.pem:private-key-block:1