Remove .pem files that trigger security scan alerts
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 778
- Avg merge
- 2h 50m
- Merged PRs (30d)
- 3
Description
The following 4 .pem files trigger alarms in container and VM scanning tools due to the private keys.
```
.../distributed/tests/
tls-ca-key.pem
tls-key-cert.pem
tls-key.pem
tls-self-signed-key.pem
```
The other 4 .pem files are related, but don't work without the others.
```
tls-ca-cert.pem
tls-cert-chain.pem
tls-cert.pem
tls-self-signed-cert.pem
```
Proposed solution is to remove all .pem files from the repo, and use the existing `distributed/tests/make_tls_certs.py` script during the test setup (runtime <0.5s), and delete the files after the tests are run. Also add *.pem to .gitignore to prevent recurrence.
This introduces a dependency on `openssl`, which should be on any modern Unix machine but will be an issue for Windows.
Contributor guide
Assessment
This issue has not been assessed yet.