Skip to content

Commit 87dd505

Browse files
committed
use Defang secret-detector to identify potential secret leaks before publishing OCI artifacts
Signed-off-by: Guillaume Lours <[email protected]>
1 parent b237289 commit 87dd505

File tree

5 files changed

+94
-11
lines changed

5 files changed

+94
-11
lines changed

go.mod

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ require (
6666
dario.cat/mergo v1.0.1 // indirect
6767
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
6868
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
69+
github.com/DefangLabs/secret-detector v0.0.0-20250108223530-c2b44d4c1f8f // indirect
6970
github.com/Masterminds/semver/v3 v3.2.1 // indirect
7071
github.com/a8m/envsubst v1.4.2 // indirect
7172
github.com/alecthomas/participle/v2 v2.1.1 // indirect
@@ -116,6 +117,7 @@ require (
116117
github.com/goccy/go-yaml v1.13.3 // indirect
117118
github.com/gofrs/flock v0.12.1 // indirect
118119
github.com/gogo/protobuf v1.3.2 // indirect
120+
github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
119121
github.com/golang/protobuf v1.5.4 // indirect
120122
github.com/google/gnostic-models v0.6.8 // indirect
121123
github.com/google/gofuzz v1.2.0 // indirect
@@ -129,6 +131,7 @@ require (
129131
github.com/imdario/mergo v0.3.16 // indirect
130132
github.com/in-toto/in-toto-golang v0.5.0 // indirect
131133
github.com/inconshreveable/mousetrap v1.1.0 // indirect
134+
github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect
132135
github.com/jinzhu/copier v0.4.0 // indirect
133136
github.com/josharian/intern v1.0.0 // indirect
134137
github.com/json-iterator/go v1.1.12 // indirect
@@ -202,6 +205,7 @@ require (
202205
google.golang.org/protobuf v1.36.4 // indirect
203206
gopkg.in/cenkalti/backoff.v1 v1.1.0 // indirect
204207
gopkg.in/inf.v0 v0.9.1 // indirect
208+
gopkg.in/ini.v1 v1.66.2 // indirect
205209
gopkg.in/yaml.v2 v2.4.0 // indirect
206210
k8s.io/api v0.31.2 // indirect
207211
k8s.io/apimachinery v0.31.2 // indirect

go.sum

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEK
1010
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
1111
github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
1212
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
13+
github.com/DefangLabs/secret-detector v0.0.0-20250108223530-c2b44d4c1f8f h1:RTbUqLhPxejgK92ifVdMTIW9H23QLlscy8QXPDTfaL4=
14+
github.com/DefangLabs/secret-detector v0.0.0-20250108223530-c2b44d4c1f8f/go.mod h1:2UjtD/G/Sy2FxoHpxKnzHTXMpRURecwYal8HgbxcvkY=
1315
github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
1416
github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
1517
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
@@ -221,6 +223,8 @@ github.com/gogo/protobuf v1.0.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7a
221223
github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
222224
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
223225
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
226+
github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
227+
github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
224228
github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
225229
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
226230
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -277,6 +281,8 @@ github.com/in-toto/in-toto-golang v0.5.0/go.mod h1:/Rq0IZHLV7Ku5gielPT4wPHJfH1Gd
277281
github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
278282
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
279283
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
284+
github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf h1:FtEj8sfIcaaBfAKrE1Cwb61YDtYq9JxChK1c7AKce7s=
285+
github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf/go.mod h1:yrqSXGoD/4EKfF26AOGzscPOgTTJcyAwM2rpixWT+t4=
280286
github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
281287
github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
282288
github.com/jinzhu/gorm v0.0.0-20170222002820-5409931a1bb8 h1:CZkYfurY6KGhVtlalI4QwQ6T0Cu6iuY3e0x5RLu96WE=
@@ -682,6 +688,8 @@ gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMy
682688
gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
683689
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
684690
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
691+
gopkg.in/ini.v1 v1.66.2 h1:XfR1dOYubytKy4Shzc2LHrrGhU0lDCfDGG1yLPmpgsI=
692+
gopkg.in/ini.v1 v1.66.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
685693
gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473 h1:6D+BvnJ/j6e222UW8s2qTSe3wGBtvo0MbVQG/c5k8RE=
686694
gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473/go.mod h1:N1eN2tsCx0Ydtgjl4cqmbRCsY4/+z4cYDeqwZTk6zog=
687695
gopkg.in/rethinkdb/rethinkdb-go.v6 v6.2.1 h1:d4KQkxAaAiRY2h5Zqis161Pv91A37uZyJOx73duwUwM=

pkg/compose/publish.go

Lines changed: 57 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,16 @@
1717
package compose
1818

1919
import (
20+
"bytes"
2021
"context"
2122
"crypto/sha256"
2223
"errors"
2324
"fmt"
2425
"os"
2526

27+
"github.com/DefangLabs/secret-detector/pkg/scanner"
28+
"github.com/DefangLabs/secret-detector/pkg/secrets"
29+
2630
"github.com/compose-spec/compose-go/v2/loader"
2731
"github.com/compose-spec/compose-go/v2/types"
2832
"github.com/distribution/reference"
@@ -259,15 +263,37 @@ func (s *composeService) generateImageDigestsOverride(ctx context.Context, proje
259263
return override.MarshalYAML()
260264
}
261265

266+
//nolint:gocyclo
262267
func (s *composeService) preChecks(project *types.Project, options api.PublishOptions) (bool, error) {
263-
if ok, err := s.checkOnlyBuildSection(project); !ok {
268+
if ok, err := s.checkOnlyBuildSection(project); !ok || err != nil {
269+
return false, err
270+
}
271+
if ok, err := s.checkForBindMount(project); !ok || err != nil {
272+
return false, err
273+
}
274+
if options.AssumeYes {
275+
return true, nil
276+
}
277+
detectedSecrets, err := s.checkForSensitiveData(project)
278+
if err != nil {
264279
return false, err
265280
}
281+
if len(detectedSecrets) > 0 {
282+
fmt.Println("you are about to publish sensitive data within your OCI artifact.\n" +
283+
"please double check that you are not leaking sensitive data")
284+
for _, val := range detectedSecrets {
285+
_, _ = fmt.Fprintln(s.dockerCli.Out(), val.Type)
286+
_, _ = fmt.Fprintf(s.dockerCli.Out(), "%q: %s\n", val.Key, val.Value)
287+
}
288+
if ok, err := acceptPublishSensitiveData(s.dockerCli); err != nil || !ok {
289+
return false, err
290+
}
291+
}
266292
envVariables, err := s.checkEnvironmentVariables(project, options)
267293
if err != nil {
268294
return false, err
269295
}
270-
if !options.AssumeYes && len(envVariables) > 0 {
296+
if len(envVariables) > 0 {
271297
fmt.Println("you are about to publish environment variables within your OCI artifact.\n" +
272298
"please double check that you are not leaking sensitive data")
273299
for key, val := range envVariables {
@@ -276,17 +302,10 @@ func (s *composeService) preChecks(project *types.Project, options api.PublishOp
276302
_, _ = fmt.Fprintf(s.dockerCli.Out(), "%s=%v\n", k, *v)
277303
}
278304
}
279-
return acceptPublishEnvVariables(s.dockerCli)
280-
}
281-
282-
for name, config := range project.Services {
283-
for _, volume := range config.Volumes {
284-
if volume.Type == types.VolumeTypeBind {
285-
return false, fmt.Errorf("cannot publish compose file: service %q relies on bind-mount. You should use volumes", name)
286-
}
305+
if ok, err := acceptPublishEnvVariables(s.dockerCli); err != nil || !ok {
306+
return false, err
287307
}
288308
}
289-
290309
return true, nil
291310
}
292311

@@ -332,6 +351,12 @@ func acceptPublishEnvVariables(cli command.Cli) (bool, error) {
332351
return confirm, err
333352
}
334353

354+
func acceptPublishSensitiveData(cli command.Cli) (bool, error) {
355+
msg := "Are you ok to publish these sensitive data? [y/N]: "
356+
confirm, err := prompt.NewPrompt(cli.In(), cli.Out()).Confirm(msg, false)
357+
return confirm, err
358+
}
359+
335360
func envFileLayers(project *types.Project) []ocipush.Pushable {
336361
var layers []ocipush.Pushable
337362
for _, service := range project.Services {
@@ -367,3 +392,24 @@ func (s *composeService) checkOnlyBuildSection(project *types.Project) (bool, er
367392
}
368393
return true, nil
369394
}
395+
396+
func (s *composeService) checkForBindMount(project *types.Project) (bool, error) {
397+
for name, config := range project.Services {
398+
for _, volume := range config.Volumes {
399+
if volume.Type == types.VolumeTypeBind {
400+
return false, fmt.Errorf("cannot publish compose file: service %q relies on bind-mount. You should use volumes", name)
401+
}
402+
}
403+
}
404+
return true, nil
405+
}
406+
407+
func (s *composeService) checkForSensitiveData(project *types.Project) ([]secrets.DetectedSecret, error) {
408+
scan := scanner.NewDefaultScanner()
409+
410+
input, err := project.MarshalYAML()
411+
if err != nil {
412+
return nil, err
413+
}
414+
return scan.ScanReader(bytes.NewReader(input))
415+
}
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
services:
2+
serviceA:
3+
image: "alpine:3.12"
4+
environment:
5+
- AWS_ACCESS_KEY_ID=A3TX1234567890ABCDEF
6+
- AWS_SECRET_ACCESS_KEY=aws"12345+67890/abcdefghijklm+NOPQRSTUVWXYZ+"
7+
serviceB:
8+
image: "alpine:3.12"
9+
environment:
10+
- GITHUB_TOKEN=ghp_1234567890abcdefghijklmnopqrstuvwxyz

pkg/e2e/publish_test.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,4 +134,19 @@ FOO=bar`), res.Combined())
134134
"-p", projectName, "alpha", "publish", "test/test", "--dry-run")
135135
res.Assert(t, icmd.Expected{ExitCode: 1, Err: "cannot publish compose file with local includes"})
136136
})
137+
138+
t.Run("detect sensitive data", func(t *testing.T) {
139+
cmd := c.NewDockerComposeCmd(t, "-f", "./fixtures/publish/compose-sensitive.yml",
140+
"-p", projectName, "alpha", "publish", "test/test", "--with-env", "--dry-run")
141+
cmd.Stdin = strings.NewReader("n\n")
142+
res := icmd.RunCmd(cmd)
143+
res.Assert(t, icmd.Expected{ExitCode: 0})
144+
145+
output := res.Combined()
146+
assert.Assert(t, strings.Contains(output, "you are about to publish sensitive data within your OCI artifact.\n"), output)
147+
assert.Assert(t, strings.Contains(output, "please double check that you are not leaking sensitive data"), output)
148+
assert.Assert(t, strings.Contains(output, "AWS Client ID\n\"services.serviceA.environment.AWS_ACCESS_KEY_ID\": A3TX1234567890ABCDEF"), output)
149+
assert.Assert(t, strings.Contains(output, "AWS Secret Key\n\"services.serviceA.environment.AWS_SECRET_ACCESS_KEY\": aws\"12345+67890/abcdefghijklm+NOPQRSTUVWXYZ+\""), output)
150+
assert.Assert(t, strings.Contains(output, "Github authentication\n\"services.serviceB.environment.GITHUB_TOKEN\": ghp_1234567890abcdefghijklmnopqrstuvwxyz"), output)
151+
})
137152
}

0 commit comments

Comments
 (0)