awslabs / awslabs/git-secrets

Different values for `git config --get-all`

Open
#179 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
13.4k
Forks
1.3k
PR merge metrics
No merged PRs in 30d

Description

I'm attempt to use `git secrets --scan-history` in CI, but I'm currently get false-positives because `git config --get-all secrets.patterns` is empty on my CI server but populated on my development machine.

# CI

```shell
$ git config --get-all secrets.patterns
(sk|pk)_(test|live)_[0-9a-zA-Z]{99}
$ cat .git/config
[secrets]
patterns = (sk|pk)_(test|live)_[0-9a-zA-Z]{99}
```

# Dev

```shell
$ git config --get-all secrets.patterns
(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}
("|')?(AWS|aws|Aws)?_?(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)("|')?\s*(:|=>|=)\s*("|')?[A-Za-z0-9/\+=]{40}("|')?
("|')?(AWS|aws|Aws)?_?(ACCOUNT|account|Account)_?(ID|id|Id)?("|')?\s*(:|=>|=)\s*("|')?[0-9]{4}\-?[0-9]{4}\-?[0-9]{4}("|')?
AIza[0-9A-Za-z_-]{35}
[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com
(^|[^0-9A-Za-z/+])1/[0-9A-Za-z_-]{43}
(^|[^0-9A-Za-z/+])1/[0-9A-Za-z_-]{64}
ya29\.[0-9A-Za-z_-]+
(sk|pk)_(test|live)_[a-zA-Z0-9]{99}
$ command cat .git/config
[secrets]
patterns = (sk|pk)_(test|live)_[a-zA-Z0-9]{99}
```

# Investigation

Where else can these `secrets.patterns` be defined? On my dev machine, I searched through my `history` for any calls `--add-provider` or `--add` for patterns, but I cannot find anything that would've added all of these patterns:

```shell
$ history | egrep '^git(-| )secrets' | sort | uniq
git secrets
git secrets --add-provider -- git secrets
git secrets --add-provider -h
git secrets --commit_msg_hook
git secrets --help
git secrets --install
git-secrets --list
git-secrets --list --help
git secrets --register-gcp
git secrets --scan
git secrets scan
git-secrets --scan
git secrets --scan | grep Stripe
git secrets --scan-history
```

I also tried to find any `gitconfig` file that might have a `[secrets]` header... I haven't found anything yet:

```shell
$ sudo updatedb
$ locate gitconfig | xargs rg '\[secrets\]'
# empty
```

To be clear, I'd like my CI machine to have the same patterns as my dev machine. Can someone help me troubleshoot this? Both machines are using `git-secrets-1.3.0`.

Contributor guide

Open the contributing guide

Research direction

Start by comparing `git config --get-all secrets.patterns` and the repository `.git/config` on both machines, then inspect the configuration sources used by `git-secrets --scan-history`. Trace why the development machine has additional patterns despite the shown repository config; done means the cause is identified and the CI machine can load the same patterns reliably.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, shell
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.