Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(secret): ignore .dist-info directory for Python projects #8212

Open
knqyf263 opened this issue Jan 8, 2025 Discussed in #8199 · 0 comments
Open

feat(secret): ignore .dist-info directory for Python projects #8212

knqyf263 opened this issue Jan 8, 2025 Discussed in #8199 · 0 comments
Labels
help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. scan/secret Issues relating to secret scanning

Comments

@knqyf263
Copy link
Collaborator

knqyf263 commented Jan 8, 2025

Description

According to the document, .dist-info directory contains metadata files. Trivy doesn't need to detect secrets on these files.

Each project installed from a distribution must, in addition to files, install a “.dist-info” directory located alongside importable modules and packages (commonly, the site-packages directory).

We can add a new allow rule.
https://github.com/aquasecurity/trivy/blob/bbc5a85444ec86b7bb26d6db27803d199431a8e6/pkg/fanal/secret/builtin-allow-rules.go

Discussed in #8199
@knqyf263 knqyf263 added help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. scan/secret Issues relating to secret scanning labels Jan 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. scan/secret Issues relating to secret scanning
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@knqyf263