Releases: GitGuardian/ggshield
1.23.0
Added
-
GGShield output now adapts when the grace period of an IaC incident ignored by a developer has been expired.
-
GGShield now shows a warning message if it hits a rate-limit.
Changed
- IaC incidents ignored on the GitGuardian app no longer show up in the scan results.
Fixed
-
IaC/SCA scans now properly find the parent commit SHA on GitLab push pipelines for new branches.
-
Error messages now appear above progress bars instead of overlapping them.
IaC
-
File content are now displayed as intended when executing
ggshield iac scan all
on a subdirectory of a Git repository. -
Pre-push scans are now diff scans when pushing a new branch, comparing to the last commit of the parent branch.
-
Pre-push scans on empty repositories no longer include staged files.
1.22.0
Added
-
Secret: ggshield now prints the name of what is being scanned when called with
--verbose
(#212). -
You can now use the
SKIP=ggshield
environment variable without the pre-commit framework to skip pre-commit and pre-push scans.
Changed
- ggshield can now scan huge commits without running out of memory.
Fixed
- IAC and SCA: scans in GitLab merge request pipelines should now be performed on the intended commit ranges, instead of an empty range.
1.21.0
Added
- Support for new options in gitguardian config file. IaC
ignored-paths
andignored_policies
can now be defined as objects withcomment
anduntil
properties. If anuntil
date is provided, the path/policy is only ignored up until this date. The old format is still supported. Check.gitguardian.example.yaml
for a sample.
Changed
-
ggshield iac scan diff --json
output was changed.added_vulns
,persisting_vulns
andremoved_vulns
were renamed asnew
,unchanged
anddeleted
. They also were moved into aentities_with_incidents
similarly to the scan all JSON output.Sample IaC diff JSON output
```json { "id": "fb0e9a92-de34-43f9-b779-17d25e99ab35", "iac_engine_version": "1.15.0", "type": "diff_scan", "entities_with_incidents": { "unchanged": [ { "filename": "s3.tf", "incidents": [ { "policy": "Allowing public exposure of a S3 bucket can lead to data leakage", "policy_id": "GG_IAC_0055", "line_end": 118, "line_start": 96, "description": "AWS S3 Block Public Access is a feature that allows setting up centralized controls\\nto manage public access to S3 resources.\\n\\nEnforcing the BlockPublicAcls, BlockPublicPolicy and IgnorePublicAcls rule on a bucket\\nallows to make sure that no ACL (Access control list) or policy giving public access\\ncan be associated with the bucket, and that existing ACL giving public access to\\nthe bucket will not be taken into account.", "documentation_url": "<https://docs.gitguardian.com/iac-scanning/policies/GG_IAC_0055>", "component": "aws_s3_bucket.operations", "severity": "HIGH" } ], "total_incidents": 1 } ], "deleted": [ { "filename": "s3.tf", "incidents": [ { "policy": "Allowing public exposure of a S3 bucket can lead to data leakage", "policy_id": "GG_IAC_0055", "line_end": 118, "line_start": 96, "description": "AWS S3 Block Public Access is a feature that allows setting up centralized controls\\nto manage public access to S3 resources.\\n\\nEnforcing the BlockPublicAcls, BlockPublicPolicy and IgnorePublicAcls rule on a bucket\\nallows to make sure that no ACL (Access control list) or policy giving public access\\ncan be associated with the bucket, and that existing ACL giving public access to\\nthe bucket will not be taken into account.", "documentation_url": "<https://docs.gitguardian.com/iac-scanning/policies/GG_IAC_0055>", "component": "aws_s3_bucket.operations", "severity": "HIGH", } ], "total_incidents": 1 } ], "new": [ { "filename": "s3.tf", "incidents": [ { "policy": "Allowing public exposure of a S3 bucket can lead to data leakage", "policy_id": "GG_IAC_0055", "line_end": 118, "line_start": 96, "description": "AWS S3 Block Public Access is a feature that allows setting up centralized controls\\nto manage public access to S3 resources.\\n\\nEnforcing the BlockPublicAcls, BlockPublicPolicy and IgnorePublicAcls rule on a bucket\\nallows to make sure that no ACL (Access control list) or policy giving public access\\ncan be associated with the bucket, and that existing ACL giving public access to\\nthe bucket will not be taken into account.", "documentation_url": "<https://docs.gitguardian.com/iac-scanning/policies/GG_IAC_0055>", "component": "aws_s3_bucket.operations", "severity": "HIGH" } ], "total_incidents": 1 } ] } } ```
Fixed
- When a git command fails, its output is now always correctly logged.
1.20.0
Changed
HMSL
-
Adapt message in case we find tons of matches
-
command
hmsl check-secret-manager hashicorp-vault
with a "key" naming strategy will display the variable's full path instead of the variable name -
Support no location URL in HMSL response.
-
Change wording for HMSL output: do not mention occurrences as it can be misleading.
1.19.1
Removed
- ggshield now refuses to install on python < 3.8
Added
HMSL
- Added new
ggshield hmsl check-secret-manager hashicorp-vault
command to scan secrets of an HashiCorp Vault instance.
Changed
- Help messages have been improved and are now kept in sync with ggshield online reference documentation.
Fixed
-
Fixed a typo in the command suggested to tell git a directory is safe.
-
The bug on Gitlab CI for IaC and SCA, failing because git does not access the target branch in a merge request is fixed. Now fetches the target branch in the CI env before collecting commit shas.
-
Fix IaC and SCA scan commands in Windows
1.18.1
Fixed
-
Fixed a bug which caused IaC and SCA scans to fail on GitLab CI because GitLab does not run
git fetch
on the target branch for merge requests. ggshield now runsgit fetch
itself to avoid this problem. -
Fixed a typo in the command suggested to tell git a directory is safe.
1.18.0
Added
HMSL
- ggshield gained a new group of commands:
hmsl
, short for "Has My Secret Leaked". These commands make it possible to securely check if secrets have been leaked in a public repository.
IaC
-
ggshield iac scan
now provides three new commands for use as Git hooks:ggshield iac scan pre-commit
ggshield iac scan pre-push
ggshield iac scan pre-receive
They use the same arguments and options as the other
ggshield iac scan
commands. -
The new
ggshield iac scan ci
command can be used to perform IaC scans in CI environments.
It supports the same arguments as hook subcommands (in particular,--all
to scan the whole repository).
Supported CIs are:- Azure
- Bitbucket
- CircleCI
- Drone
- GitHub
- GitLab
- Jenkins
- Travis
SCA
-
Introduces new commands to perform SCA scans with ggshield:
ggshield sca scan all <DIRECTORY>
: scans a directory or a repository to find all existing SCA vulnerabilities.ggshield sca scan diff <DIRECTORY> --ref <GIT_REF>
: runs differential scan compared to a given git ref.ggshield sca scan pre-commit
ggshield sca scan pre-push
ggshield sca scan pre-receive
ggshield sca scan ci
: Evaluates if a CI event introduces new vulnerabilities, only available on Github and Gitlab for now.
Other
-
It is now possible to manipulate the default instance using
ggshield config
:ggshield config set instance <THE_INSTANCE_URL>
defines the default instance.ggshield config unset instance
removes the previously defined instance.- The default instance can be printed with
ggshield config get instance
andggshield config list
.
Changed
-
ggshield now requires Python 3.8.
-
The IaC Github Action now runs the new
ggshield iac scan ci
command. This means the action only fails if the changes introduce a new vulnerability. To fail if any vulnerability is detected, use theggshield iac scan ci --all
command.
Removed
- The following options have been removed from
ggshield iac scan diff
:--pre-commit
,--pre-push
and--pre-receive
. You can replace them with the newggshield iac scan pre-*
commands.
Fixed
-
ggshield secret scan docker
now runs as many scans in parallel as the other scan commands. -
ggshield
now provides an easier-to-understand error message for "quota limit reached" errors (#309). -
ggshield iac scan diff
--minimum-severity
and--ignore-policy
options are now correctly processed. -
ggshield secret scan
no longer tries to scan files longer than the maximum document size (#561).
Security
- ggshield now depends on cryptography 41.0.3, fixing GHSA-jm77-qphf-c4w8.
1.17.3
Fixed
- Pin PyYAML>=6.0.1 to fix building (see yaml/pyyaml#702)
1.17.2
Fixed
- Fixed ggshield not installing properly when installing with Brew on macOS.
1.17.1
Added
-
New command:
ggshield iac scan all
. This command replaces the now-deprecatedggshield iac scan
. It scans a directory for IaC vulnerabilities. -
New command:
ggshield iac scan diff
. This command scans a Git repository and inspects changes in IaC vulnerabilities between two points in the history.- All options from
ggshield iac scan all
are supported:--ignore-policy
,--minimum-severity
,--ignore-path
etc. Executeggshield iac scan diff -h
for more details. - Two new options allow to choose which state to select for the difference:
--ref <GIT-REFERENCE>
and--staged
. - The command can be integrated in Git hooks using the
--pre-commit
,--pre-push
,--pre-receive
options. - The command output list vulnerabilities as
unchanged
,new
anddeleted
.
- All options from
-
Added a
--log-file FILE
option to redirect all logging output to a file. The option can also be set using the$GITGUARDIAN_LOG_FILE
environment variable.
Changed
-
Improved
secret scan path
speed by updating charset-normalizer to 3.1. -
Errors are no longer reported twice: first using human-friendly message and then using log output. Log output is now off by default, unless
--debug
or--log-file
is set (#213). -
The help messages for the
honeytoken
commands have been updated. -
ggshield honeytoken create
now displays an easier-to-understand error message when the user does not have the necessary permissions to create an honeytoken. -
ggshield auth login
now displays a warning message if the token expiration date has been adjusted to comply with the personal access token maximum lifetime setting of the user's workspace.
Deprecated
ggshield iac scan
is now replaced by the newggshield iac scan all
, which supports the same options and arguments.