|
| 1 | +#!/bin/sh |
| 2 | +set -eu |
| 3 | + |
| 4 | +cd "$(git rev-parse --show-toplevel)" |
| 5 | + |
| 6 | +for tool in git curl tar mktemp awk xargs uname tr dirname; do |
| 7 | + command -v "$tool" >/dev/null 2>&1 || { echo "secrets-scan: required tool '$tool' not found in PATH" >&2; exit 1; } |
| 8 | +done |
| 9 | +if ! command -v sha256sum >/dev/null 2>&1 && ! command -v shasum >/dev/null 2>&1; then |
| 10 | + echo "secrets-scan: required tool 'sha256sum' or 'shasum' not found in PATH" >&2 |
| 11 | + exit 1 |
| 12 | +fi |
| 13 | + |
| 14 | +HOOK_NAME="$1" |
| 15 | + |
| 16 | +TALISMAN_VERSION="v1.37.0" |
| 17 | +TRUFFLEHOG_VERSION="3.96.0" |
| 18 | +CACHE_DIR="$HOME/.cache/secrets-scan-tools" |
| 19 | +mkdir -p "$CACHE_DIR" |
| 20 | + |
| 21 | +OS=$(uname -s | tr '[:upper:]' '[:lower:]') |
| 22 | +ARCH_RAW=$(uname -m) |
| 23 | +case "$ARCH_RAW" in |
| 24 | + x86_64) ARCH=amd64 ;; |
| 25 | + arm64|aarch64) ARCH=arm64 ;; |
| 26 | + *) ARCH="$ARCH_RAW" ;; |
| 27 | +esac |
| 28 | + |
| 29 | +# Pinned checksums (from https://github.com/thoughtworks/talisman/releases/download/v1.37.0/checksums |
| 30 | +# and https://github.com/trufflesecurity/trufflehog/releases/download/v3.96.0/trufflehog_3.96.0_checksums.txt), |
| 31 | +# committed here rather than fetched at runtime - the whole point is to not trust a checksums file |
| 32 | +# downloaded from the same release as the binary it's meant to verify. |
| 33 | +case "${OS}_${ARCH}" in |
| 34 | + darwin_amd64) |
| 35 | + TALISMAN_SHA256="9a67e015d6c99650c45d653ce4a597f885bf661164c2671f08a3827013b277fb" |
| 36 | + TRUFFLEHOG_SHA256="a30d8f1095e031a81a668e1582f2ed479c3b50476cef86317e0fb74210c33617" |
| 37 | + ;; |
| 38 | + darwin_arm64) |
| 39 | + TALISMAN_SHA256="4806746b2ba0190941f0606853990b4da6eb7df2d64c261212a6aa66eb6b15c2" |
| 40 | + TRUFFLEHOG_SHA256="87478306b95ca2420cfb844b7582383ac60b922e262350a0088e797f328d2e62" |
| 41 | + ;; |
| 42 | + linux_amd64) |
| 43 | + TALISMAN_SHA256="8e0ae8bb7b160bf10c4fa1448beb04a32a35e63505b3dddff74a092bccaaa7e4" |
| 44 | + TRUFFLEHOG_SHA256="7105f1cd6577f058a9e39d0578f1a99c8a1e481e4d3512cd8a09acfe22a0fdc0" |
| 45 | + ;; |
| 46 | + linux_arm64) |
| 47 | + TALISMAN_SHA256="ca706f428a45d7a4ed3cc5c3cf7b3e5b0dfce6f2f584000a117d0d602a0342b7" |
| 48 | + TRUFFLEHOG_SHA256="50acd4c7a3b8ebfe5083d8350956057030c44be3515dedd55b45263495c490b2" |
| 49 | + ;; |
| 50 | + *) |
| 51 | + echo "secrets-scan: no pinned checksum for platform ${OS}_${ARCH} (talisman ${TALISMAN_VERSION} / trufflehog ${TRUFFLEHOG_VERSION})" >&2 |
| 52 | + exit 1 |
| 53 | + ;; |
| 54 | +esac |
| 55 | + |
| 56 | +if command -v sha256sum >/dev/null 2>&1; then |
| 57 | + checksum() { sha256sum "$1" | awk '{print $1}'; } |
| 58 | +else |
| 59 | + checksum() { shasum -a 256 "$1" | awk '{print $1}'; } |
| 60 | +fi |
| 61 | + |
| 62 | +TALISMAN_BIN="$CACHE_DIR/talisman_${TALISMAN_VERSION}_${OS}_${ARCH}" |
| 63 | +if [ ! -x "$TALISMAN_BIN" ]; then |
| 64 | + echo "secrets-scan: downloading Talisman ${TALISMAN_VERSION}..." |
| 65 | + curl -fsSL -o "${TALISMAN_BIN}.tmp" "https://github.com/thoughtworks/talisman/releases/download/${TALISMAN_VERSION}/talisman_${OS}_${ARCH}" |
| 66 | + ACTUAL_HASH=$(checksum "${TALISMAN_BIN}.tmp") |
| 67 | + if [ "$ACTUAL_HASH" != "$TALISMAN_SHA256" ]; then |
| 68 | + echo "secrets-scan: Talisman checksum verification FAILED" >&2 |
| 69 | + rm -f "${TALISMAN_BIN}.tmp" |
| 70 | + exit 1 |
| 71 | + fi |
| 72 | + mv "${TALISMAN_BIN}.tmp" "$TALISMAN_BIN" |
| 73 | + chmod +x "$TALISMAN_BIN" |
| 74 | +fi |
| 75 | + |
| 76 | +TRUFFLEHOG_DIR="$CACHE_DIR/trufflehog_${TRUFFLEHOG_VERSION}_${OS}_${ARCH}" |
| 77 | +TRUFFLEHOG_BIN="$TRUFFLEHOG_DIR/trufflehog" |
| 78 | +if [ ! -x "$TRUFFLEHOG_BIN" ]; then |
| 79 | + echo "secrets-scan: downloading trufflehog ${TRUFFLEHOG_VERSION}..." |
| 80 | + mkdir -p "$TRUFFLEHOG_DIR" |
| 81 | + TARBALL="$CACHE_DIR/trufflehog_${TRUFFLEHOG_VERSION}_${OS}_${ARCH}.tar.gz" |
| 82 | + curl -fsSL -o "$TARBALL" "https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_${OS}_${ARCH}.tar.gz" |
| 83 | + ACTUAL_HASH=$(checksum "$TARBALL") |
| 84 | + if [ "$ACTUAL_HASH" != "$TRUFFLEHOG_SHA256" ]; then |
| 85 | + echo "secrets-scan: trufflehog checksum verification FAILED" >&2 |
| 86 | + rm -f "$TARBALL" |
| 87 | + exit 1 |
| 88 | + fi |
| 89 | + tar -xzf "$TARBALL" -C "$TRUFFLEHOG_DIR" |
| 90 | + chmod +x "$TRUFFLEHOG_BIN" |
| 91 | +fi |
| 92 | + |
| 93 | +case "$HOOK_NAME" in |
| 94 | + pre-commit) |
| 95 | + "$TALISMAN_BIN" --githook pre-commit |
| 96 | + |
| 97 | + STAGED_LIST=$(mktemp) |
| 98 | + STAGE_DIR=$(mktemp -d) |
| 99 | + trap 'rm -f "$STAGED_LIST"; rm -rf "$STAGE_DIR"' EXIT |
| 100 | + git diff --cached --name-only --diff-filter=ACM -z > "$STAGED_LIST" |
| 101 | + if [ -s "$STAGED_LIST" ]; then |
| 102 | + export STAGE_DIR |
| 103 | + xargs -0 sh -c 'for f; do mkdir -p "$STAGE_DIR/$(dirname "$f")"; git show ":$f" > "$STAGE_DIR/$f"; done' _ < "$STAGED_LIST" |
| 104 | + "$TRUFFLEHOG_BIN" filesystem --fail --no-update --results=verified,unverified,unknown "$STAGE_DIR" |
| 105 | + fi |
| 106 | + ;; |
| 107 | + pre-push) |
| 108 | + REMOTE_NAME="${2:-origin}" |
| 109 | + STDIN_DATA=$(cat) |
| 110 | + if [ -z "$STDIN_DATA" ]; then |
| 111 | + exit 0 |
| 112 | + fi |
| 113 | + |
| 114 | + DEFAULT_REF=$(git symbolic-ref -q --short "refs/remotes/${REMOTE_NAME}/HEAD" 2>/dev/null || echo "") |
| 115 | + DEFAULT_BASE="" |
| 116 | + [ -n "$DEFAULT_REF" ] && DEFAULT_BASE=$(git rev-parse --verify "$DEFAULT_REF" 2>/dev/null || echo "") |
| 117 | + [ -z "$DEFAULT_BASE" ] && DEFAULT_BASE=$(git rev-parse --verify "${REMOTE_NAME}/main" 2>/dev/null || echo "") |
| 118 | + [ -z "$DEFAULT_BASE" ] && DEFAULT_BASE=$(git rev-parse --verify "${REMOTE_NAME}/master" 2>/dev/null || echo "") |
| 119 | + |
| 120 | + RESOLVED_STDIN="" |
| 121 | + while read -r LOCAL_REF LOCAL_SHA REMOTE_REF REMOTE_SHA; do |
| 122 | + [ -z "$LOCAL_SHA" ] && continue |
| 123 | + [ "$LOCAL_SHA" = "0000000000000000000000000000000000000000" ] && continue |
| 124 | + if [ -z "$REMOTE_SHA" ] || [ "$REMOTE_SHA" = "0000000000000000000000000000000000000000" ]; then |
| 125 | + REMOTE_SHA="$DEFAULT_BASE" |
| 126 | + fi |
| 127 | + if [ -z "$REMOTE_SHA" ]; then |
| 128 | + echo "secrets-scan: could not determine a base commit to scan ${LOCAL_REF} against (no ${REMOTE_NAME}/HEAD, ${REMOTE_NAME}/main, or ${REMOTE_NAME}/master found locally) - refusing to silently skip the scan. Run 'git fetch ${REMOTE_NAME}' and try again." >&2 |
| 129 | + exit 1 |
| 130 | + fi |
| 131 | + RESOLVED_STDIN="${RESOLVED_STDIN}${LOCAL_REF} ${LOCAL_SHA} ${REMOTE_REF} ${REMOTE_SHA} |
| 132 | +" |
| 133 | + "$TRUFFLEHOG_BIN" git "file://$(pwd)" --since-commit "$REMOTE_SHA" --branch "$LOCAL_SHA" --fail --no-update --results=verified,unverified,unknown |
| 134 | + done <<EOF |
| 135 | +$STDIN_DATA |
| 136 | +EOF |
| 137 | + |
| 138 | + if [ -n "$RESOLVED_STDIN" ]; then |
| 139 | + printf '%s' "$RESOLVED_STDIN" | "$TALISMAN_BIN" --githook pre-push |
| 140 | + fi |
| 141 | + ;; |
| 142 | + *) |
| 143 | + echo "secrets-scan: unknown hook '$HOOK_NAME'" >&2 |
| 144 | + exit 1 |
| 145 | + ;; |
| 146 | +esac |
0 commit comments