Skip to content

gitleaks: cannot use fork features #790

Description

@malexmave

🐞 Bug report

I cannot get the secureCodeBox fork of gitleaks to work.

Describe the bug

According to the instructions, the following commands should install the gitleaks fork that contains the --commit-since-duration switch that is not yet part of the main gitleaks codebase:

helm upgrade --install gitleaks secureCodeBox/gitleaks \
  --set="scanner.image.repository=docker.io/securecodebox/scanner-gitleaks" \
  --set="scanner.image.tag=v7.3.0"

However, if I then run a scan, the system reports that it does not know the switch.

Steps To Reproduce

Install the gitleaks scanner as described above, then run the following scan:

apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
  name: "scan-repo"
spec:
  scanType: "gitleaks"
  parameters:
    - "--repo-url"
    - "https://github.com/secureCodeBox/secureCodeBox"
    # Apply all available rules
    - "--config-path"
    - "/home/config_all.toml"
    # Redact secrets from log messages and leaks
    - "--redact"
    # Only scan commits since the last 24h
    # (Error also occurs if you drop the =24h and place the 24h on a separate line
    - "--commit-since-duration=24h"

grafik

Expected behavior

It should scan the commits in the last 24 hours.

Additional notes

I first assumed that the mistake may be that the helm command should be as follows:

helm upgrade --install gitleaks secureCodeBox/gitleaks \
  --set="scanner.image.repository=docker.io/securecodebox/gitleaks" \  # not scanner-gitleaks
  --set="scanner.image.tag=v7.3.0"

However, if I use that, it fails because the image does not contain the wrapper.sh:

sh: can't open '/wrapper.sh': No such file or directory

I am unsure how the securecodebox/gitleaks image was built, so I cannot tell if it is just outdated and should be updated to contain the new wrapper script, or if the issue is somewhere else.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugBugsscannerImplement or update a security scanner

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions