security: pin the gitleaks download with a SHA-256 checksum

Merged
JE
4mo ago
+4647-184

Pin the gitleaks download with a SHA-256 checksum

(Threat: T5 supply chain ā€” an unpinned release download means a compromised or tampered gitleaks release asset executes in CI.)

  • gitleaks pinning: the secret-scanning workflow now verifies the gitleaks release tarball against a pinned SHA-256 (from the release checksums.txt) before installing it:

    env:
  GITLEAKS_VERSION: 8.21.2
  GITLEAKS_SHA256: 5bc41815076e6ed6ef8fbecc9d9b75bcae31f39029ceb55da08086315316e3ba
run: |
  curl -sSfL -o gitleaks.tar.gz "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
  echo "${GITLEAKS_SHA256}  gitleaks.tar.gz" | sha256sum -c -
  tar -xzf gitleaks.tar.gz gitleaks

  • gosec gate (unchanged, rationale documented): the standalone gosec scan stays advisory (-no-fail, with full SARIF upload to the Security tab). Its enforcing counterpart is golangci-lint (make lint), which honors the repo's per-site //nolint:gosec suppressions; the standalone binary can't read those, and globally excluding rule IDs (e.g. G101/G204) to make it hard-fail would blind release scans to new hard-coded creds / unsafe exec.

History

This PR originally also set toolchain go1.26.3 and bumped golang.org/x/net to v0.55.0 / golang.org/x/term to v0.43.0, taking govulncheck ./... from 6 reachable advisories to "No vulnerabilities found." Main has since independently moved to go 1.26.5 with those same dependency versions, so after rebasing onto current main the dependency changes are subsumed and only the gitleaks pin remains.

Part 6/6 of the stacked security series. Base: security/05-perms-and-exec-args.

šŸ“š Stack (merge bottom-up)

  1. #478 ā€” reject foreign-host URLs in api (base main)
  2. #479 ā€” strip ANSI/OSC escapes from output
  3. #480 ā€” harden OAuth discovery / token endpoints
  4. #481 ā€” close config trust-boundary gaps + completion gate
  5. #482 ā€” tighten config-dir perms + plugin scope argv
  6. #483 ā€” pin the gitleaks download with a SHA-256 checksum

Each is independent except #482 depends on #481 (shared root.go). #478 can land first/alone.

Summary by cubic

Pins and verifies the gitleaks v8.21.2 Linux tarball in CI using a release SHA-256 to block tampered downloads; extracts only the binary and installs it with install -m 0755 to /usr/local/bin (using GITLEAKS_VERSION/GITLEAKS_SHA256). The gosec scan stays advisory (-no-fail) with SARIF upload; enforcement remains via golangci-lint.