fecfile-web-api/install-git-secrets-hook.sh at develop · fecgov/fecfile-web-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
#!/bin/bash
#
# This utility script configures the git-secrets pre-commit hook globally
# so that all repositories cloned to your computer will run the per-commit
# scan for sensitive data. Although discouraged, you may install git secrets
# locally to the fecfile-web-api repository only by running this script using
# the "--local" command line switch.
#
# To run, first install AWS git-secret utility in your PATH so it can
# be run at the command line:
# https://github.com/awslabs/git-secrets#installing-git-secrets
#
# Once you have git-secrets installed locally, run this script in the
# root directory of your cloned fecfile-web-api repo to install the
# pre-commit hooks globally.
#
# See git-secrets README for more features:
# https://github.com/awslabs/git-secrets#readme
#
# NOTE: When committing to the repo and getting blocked by a false positive,
# there are  2 options to fix the commit: (1) skip validation by adding the
# --no-verify switch to your commit or merge (https://github.com/awslabs/git-secrets#skipping-validation)
# or (2) Add an "allowed" rule to let the commit pass based on the file name
# and line number output by the rule that flagged the possible secret.
# e.g. git secrets --add --allowed --literal '.circleci/config.yml:82'
#

# Install the git hooks for the repostory
GLOBAL_TOKEN=
if [ "$1" == "--local" ] || [ "$1" == "-l" ]; then
    # Install only to the fecfile-web-api repo.
    git secrets --install -f
else
    # Install globally by modifying the ~/.gitconfig file and creating
    # the ~/.git-support/hooks directory.
    git secrets --install -f ${HOME}/.git-support
    git config --global core.hooksPath ${HOME}/.git-support/hooks
    GLOBAL_TOKEN="--global"
fi
git secrets --register-aws $GLOBAL_TOKEN

# Add general custom rules
git secrets --add $GLOBAL_TOKEN '.*(dbpasswd|dbuser|dbname|dbhost|_key|apikey|password|guid|hostname|pw).*[=:][^(?=|>|.*=>|.*>$)]'
git secrets --add $GLOBAL_TOKEN '.*(DBPASSWD|DBUSER|DBNAME|DBHOST|_KEY|APIKEY|PASSWORD|GUID|HOSTNAME|PW).*[=:][^(?=|>|.*=>|.*>$)]'
git secrets --add $GLOBAL_TOKEN '.*(user|auth|USER|AUTH)\s*[=:][^(?=|>|.*=>|.*>$)]'
git secrets --add $GLOBAL_TOKEN '.*(aws_access_key_id|aws_secret_access_key)\s*[=:]\s*['"'"'0-9a-zA-Z\/+]{20,42}'
git secrets --add $GLOBAL_TOKEN '.*(AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*['"'"'0-9a-zA-Z\/+]{20,42}'
git secrets --add $GLOBAL_TOKEN '.*(S3_ACCESS_KEY_ID|S3_SECRET_ACCESS_KEY)\s*[=:]\s*['"'"'0-9a-zA-Z\/+]{20,42}'
git secrets --add $GLOBAL_TOKEN '.*(s3_access_key_id|s3_secret_access_key)\s*[=:]\s*['"'"'0-9a-zA-Z\/+]{20,42}'
git secrets --add $GLOBAL_TOKEN '.*(SES_ACCESS_KEY_ID|SES_SECRET_ACCESS_KEY)\s*[=:]\s*['"'"'0-9a-zA-Z\/+]{20,42}'
git secrets --add $GLOBAL_TOKEN '.*(ses_access_key_id|ses_secret_access_key)\s*[=:]\s*['"'"'0-9a-zA-Z\/+]{20,42}'

# Add rules targeting docker files
git secrets --add --literal $GLOBAL_TOKEN 'POSTGRES_PASSWORD'
git secrets --add --allowed --literal $GLOBAL_TOKEN 'POSTGRES_PASSWORD: postgres'

# Add rules targeting django-backend/fecfiler/base.py
git secrets --add --literal $GLOBAL_TOKEN 'API_LOGIN'
git secrets --add --allowed --literal $GLOBAL_TOKEN 'API_LOGIN = os.environ.get('"'"'API_LOGIN'"'"', None)'
git secrets --add --literal $GLOBAL_TOKEN 'API_PASSWORD'
git secrets --add --allowed --literal $GLOBAL_TOKEN 'API_PASSWORD = os.environ.get('"'"'API_PASSWORD'"'"', None)'
git secrets --add --literal $GLOBAL_TOKEN ''"'"'USER'"'"''
git secrets --add --allowed --literal $GLOBAL_TOKEN ''"'"'USER'"'"': os.environ.get('"'"'FECFILE_DB_USER'"'"', '"'"'postgres'"'"')'
git secrets --add --literal $GLOBAL_TOKEN ''"'"'PASSWORD'"'"''
git secrets --add --allowed --literal $GLOBAL_TOKEN ''"'"'PASSWORD'"'"': os.environ.get('"'"'FECFILE_DB_PASSWORD'"'"', '"'"'postgres'"'"')'
git secrets --add --literal $GLOBAL_TOKEN 'AWS_SECRET_ACCESS_KEY'
git secrets --add --literal $GLOBAL_TOKEN 'S3_SECRET_ACCESS_KEY'
git secrets --add --literal $GLOBAL_TOKEN 'SES_SECRET_ACCESS_KEY'
git secrets --add --allowed --literal $GLOBAL_TOKEN 's3.credentials.get('"'"'secret_access_key'"'"', None)'
git secrets --add --allowed --literal $GLOBAL_TOKEN 'os.environ['"'"'S3_SECRET_ACCESS_KEY'"'"']'
git secrets --add --allowed --literal $GLOBAL_TOKEN 'ses.credentials.get('"'"'secret_access_key'"'"', None)'
git secrets --add --allowed --literal $GLOBAL_TOKEN 'os.environ['"'"'SES_SECRET_ACCESS_KEY'"'"']'

# Add rules to allow specific safe files that don't pass the above rule screens.
git secrets --add --allowed --literal $GLOBAL_TOKEN 'install-git-secrets-hook.sh:'