Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

changed --env-exclude-sensitive-key to --env-allow-sensitive-key #563

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+6 −7
Open

changed --env-exclude-sensitive-key to --env-allow-sensitive-key #563

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions cmd/run.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,7 @@ func runRun(ctx context.Context, ro options.RunOptions, args []string, signers .
for _, dirHashGlobItem := range ro.DirHashGlobs {
_, err := glob.Compile(dirHashGlobItem)
if err != nil {
return fmt.Errorf("failed to compile glob: %v", err)
return fmt.Errorf("failed to compile glob: %v", err)
}
}

Expand All @@ -144,7 +144,7 @@ func runRun(ctx context.Context, ro options.RunOptions, args []string, signers .
attestation.WithHashes(roHashes),
attestation.WithDirHashGlob(ro.DirHashGlobs),
attestation.WithEnvCapturer(
ro.EnvAddSensitiveKeys, ro.EnvExcludeSensitiveKeys, ro.EnvDisableSensitiveVars, ro.EnvFilterSensitiveVars,
ro.EnvAddSensitiveKeys, ro.EnvAllowSensitiveKeys, ro.EnvDisableSensitiveVars, ro.EnvFilterSensitiveVars,
),
),
witness.RunWithTimestampers(timestampers...),
Expand Down
2 changes: 1 addition & 1 deletion docs/attestors/environment.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ you can use `--env-add-sensitive-key 'FOO'` for `FOO` or

There could be cases where you really want to have a specific key that is part
of the default sensitive vars list to be captured. You can do so by using the
`--env-exclude-sensitive-key`.
`--env-allow-sensitive-key`.

## Default sensitive vars

Expand Down
3 changes: 1 addition & 2 deletions docs/commands.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ witness run [cmd] [flags]
--enable-archivista Use Archivista to store or retrieve attestations
--env-add-sensitive-key strings Add keys or globs (e.g. '*TEXT') to the list of sensitive environment keys.
--env-disable-default-sensitive-vars Disable the default list of sensitive vars and only use the items mentioned by --add-sensitive-key.
--env-exclude-sensitive-key strings Exclude specific keys from the list of sensitive environment keys. Note: This does not support globs.
--env-allow-sensitive-key strings Allow specific keys from the list of sensitive environment keys. Note: This does not support globs.
--env-filter-sensitive-vars Switch from obfuscate to filtering variables which removes them from the output completely.
--hashes strings Hashes selected for digest calculation. Defaults to SHA256 (default [sha256])
-h, --help help for run
Expand Down Expand Up @@ -260,4 +260,3 @@ witness version [flags]
### SEE ALSO

* [witness](witness.md) - Collect and verify attestations about your build environments

4 changes: 2 additions & 2 deletions options/run.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ type RunOptions struct {
EnvFilterSensitiveVars bool
EnvDisableSensitiveVars bool
EnvAddSensitiveKeys []string
EnvExcludeSensitiveKeys []string
EnvAllowSensitiveKeys []string
}

var RequiredRunFlags = []string{
Expand Down Expand Up @@ -67,7 +67,7 @@ func (ro *RunOptions) AddFlags(cmd *cobra.Command) {
cmd.Flags().BoolVarP(&ro.EnvFilterSensitiveVars, "env-filter-sensitive-vars", "", false, "Switch from obfuscate to filtering variables which removes them from the output completely.")
cmd.Flags().BoolVarP(&ro.EnvDisableSensitiveVars, "env-disable-default-sensitive-vars", "", false, "Disable the default list of sensitive vars and only use the items mentioned by --add-sensitive-key.")
cmd.Flags().StringSliceVar(&ro.EnvAddSensitiveKeys, "env-add-sensitive-key", []string{}, "Add keys or globs (e.g. '*TEXT') to the list of sensitive environment keys.")
cmd.Flags().StringSliceVar(&ro.EnvExcludeSensitiveKeys, "env-exclude-sensitive-key", []string{}, "Exclude specific keys from the list of sensitive environment keys. Note: This does not support globs.")
cmd.Flags().StringSliceVar(&ro.EnvAllowSensitiveKeys, "env-allow-sensitive-key", []string{}, "Allow specific keys from the list of sensitive environment keys. Note: This does not support globs.")

cmd.MarkFlagsRequiredTogether(RequiredRunFlags...)

Expand Down