microsoft / microsoft/security-devops-azdevops
This version of checkov is flagging nuget-built files
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 86
- Forks
- 22
- PR merge metrics
- No merged PRs in 30d
Description
Please see https://github.com/bridgecrewio/checkov/issues/6984#issuecomment-2633056268
Looking at the gdnconfig, it appears that checkov is using 3.2.199, whereas it's currently on 3.2.362.
Can we convince y'all to update to that newer version of checkov? Or can we override it ourselves with our own gdnconfig?
Every repo we have is flagging sha512 checksums as high vulnerabilities.
Further information:
the version that we are getting with the MicrosoftSecurityDevOps@1 task is version 3.2.358, and this version is flagging these checksums. Checkov is currently on version 3.6.362, and the issue appears to have been fixed by 3.6.36. We cannot be the only user whose nuget-build projects are getting flagged by this - any fix or guidance is very much appreciated.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the MicrosoftSecurityDevOps@1 task and its gdnconfig, then compare the bundled Checkov versions described in the issue and linked comment. Determine whether the task can use a newer version or accept an override; done means NuGet-built repositories no longer report the affected SHA-512 checksums, or the supported configuration path is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, typescript
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100