dask / dask/distributed

Remove .pem files that trigger security scan alerts

Open
#2,562 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
1.7k
Forks
778
Avg merge
2h 50m
Merged PRs (30d)
3

Description

The following 4 .pem files trigger alarms in container and VM scanning tools due to the private keys.

```
.../distributed/tests/
tls-ca-key.pem
tls-key-cert.pem
tls-key.pem
tls-self-signed-key.pem
```
The other 4 .pem files are related, but don't work without the others.
```
tls-ca-cert.pem
tls-cert-chain.pem
tls-cert.pem
tls-self-signed-cert.pem
```
Proposed solution is to remove all .pem files from the repo, and use the existing `distributed/tests/make_tls_certs.py` script during the test setup (runtime <0.5s), and delete the files after the tests are run. Also add *.pem to .gitignore to prevent recurrence.

This introduces a dependency on `openssl`, which should be on any modern Unix machine but will be an issue for Windows.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.