feat(tooling): make deep-scan — tier-3 local analysis; fix TLS floor on reverse-bootstrap listener - #230
Merged
Conversation
…on reverse-bootstrap listener
Completes the 2026-08-07 check tiering: pre-push = fast gate, CI =
path-gated required checks with Sonar as the hosted SAST, and now
Tier-3 = the heavy/free analysis that runs on the dev machine instead
of runner minutes and sees the whole tree + whole git history instead
of a PR diff.
scripts/deep-scan.sh (make deep-scan), all sections tolerant of a
missing tool:
semgrep p/golang + p/typescript + p/security-audit, scanned
OFFLINE from ~/.cache/semgrep-rules — letting semgrep
resolve registry configs itself stalled for minutes while
curl fetched the same packs in 0.2 s, so the cache is
refreshed via curl with a hard 30 s cap
govulncheck Go CVEs with reachability
osv-scanner go.mod + web/package-lock.json against the OSV database
npm audit advisories (removed from CI as a Trivy duplicate)
gitleaks secrets over ALL 2284 commits — the CI action only scans
a push/PR commit range and can never resurface history
Findings from the first full run, all triaged:
REAL: the agent's reverse-bootstrap TLS listener (creds/reverse.go)
set no MinVersion and silently accepted TLS 1.2, while the
long-lived listener enforces 1.3 (S-7) and the CI security gate
only greps listen.go. Fixed: MinVersion 1.3, no compatibility
cost (the only peer is the panel's modern Go TLS stack).
FP, suppressed as CLASSES with reasons in scripts/semgrep-filter.py
(ratchet, archguard convention): SQL-identifier Sprintf,
math/rand jitter, dynamic cookie Secure, LimitReader-capped
decompression, rooted-path Clean over embed.FS.
FP: gitleaks generic-api-key on a function SIGNATURE (parameter list
'secret, expirationRFC3339 string') — pinned by fingerprint in
.gitleaksignore.
- gitleaks: the .gitleaksignore comment QUOTED the false-positive text, and once committed the quote itself matched generic-api-key. Reworded to describe without quoting; the already-pushed revision is pinned by its own fingerprint. - Sonar shell rules on deep-scan.sh: curl now pins --proto '=https' --tlsv1.2 (S6506), [[ ]] over [ ] (S7688), explicit returns (S7682) — as status PROPAGATION (return $?) in the scan functions, where a bare return 0 would have swallowed findings.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Реализация трёхуровневой схемы проверок, о которой договорились: тяжёлый анализ — локально и бесплатно, в GitHub остаётся лёгкий фон (Sonar).
make deep-scanВсе секции толерантны к отсутствию инструмента (SKIPPED, не падение). Ложные срабатывания подавляются как классы с записанными причинами — ratchet в стиле archguard:
scripts/semgrep-filter.py(5 классов) и.gitleaksignore(1 fingerprint — правило приняло сигнатуруsecret, expirationRFC3339 stringза API-ключ).Реальная находка первого прогона
Reverse-bootstrap TLS-листенер агента (
internal/agent/creds/reverse.go) не задавалMinVersionи молча принимал TLS 1.2 — при том что основной листенер держит floor 1.3 (S-7), а CI-гейт греппит толькоlisten.go. Исправлено на 1.3; совместимость не страдает — единственный легитимный пир это панель с современным Go TLS-стеком. Тестыinternal/agent/credsзелёные.Итог триажа первого полного прогона: 24 semgrep-находки → 1 реальная (исправлена) + 5 FP-классов; 1 gitleaks-находка → FP.
make deep-scanтеперь выходитclean.