actions/goscan
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix gosec issues
All checks were successful
GoSec Scan / Gosec Check (push) Successful in 10s
Details

Browse source
This commit is contained in:
Shane C 2024-09-13 17:10:47 -04:00
parent 03e9e6bc40
commit 97879670c1
Signed by: shanec
GPG key ID: E46B5FEA35B22FF9
1 changed files with 36 additions and 33 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

69
cmd/daemon.go
View file

@ -62,22 +62,6 @@ jobs:
uses: {{.ServerURL}}/actions/goscan@main
`
type OpenPGPEntity struct {
*openpgp.Entity
}
func (e *OpenPGPEntity) Sign(message io.Reader) ([]byte, error) {
signatureBuffer := bytes.NewBuffer(nil)
if err := openpgp.DetachSignText(signatureBuffer, e.Entity, message, nil); err != nil {
return nil, err
}
return signatureBuffer.Bytes(), nil
}
// Sign(message io.Reader) ([]byte, error)
// daemonCmd represents the daemon command
var daemonCmd = &cobra.Command{
Use: "daemon",
@ -100,7 +84,7 @@ var daemonCmd = &cobra.Command{
DefaultCipher: packet.CipherAES256,
}
var pgpEntity OpenPGPEntity
var pgpEntity *openpgp.Entity
if _, err := os.Stat(os.Getenv("HOME") + "/keyring.pgp"); err != nil {
if errors.Is(err, fs.ErrNotExist) {
@ -114,14 +98,22 @@ var daemonCmd = &cobra.Command{
if err != nil {
log.Fatal(err)
}
defer publicKeyEncoder.Close()
defer func(publicKeyEncoder io.WriteCloser) {
err := publicKeyEncoder.Close()
if err != nil {
panic(err)
}
}(publicKeyEncoder)
err = entity.Serialize(publicKeyEncoder)
if err != nil {
log.Fatal(err)
}
publicKeyEncoder.Close()
err = publicKeyEncoder.Close()
if err != nil {
log.Fatal(err)
}
publicKeyArmor := publicKeyBuffer.String()
file, err := os.OpenFile("keyring.pgp", os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
@ -129,7 +121,10 @@ var daemonCmd = &cobra.Command{
log.Fatal(err)
}
err = entity.SerializePrivate(file, conf)
file.Close()
err = file.Close()
if err != nil {
log.Fatal(err)
}
token, _, err := forgeClient.GetGPGToken()
if err != nil {
@ -146,9 +141,21 @@ var daemonCmd = &cobra.Command{
if err != nil {
log.Fatal(err)
}
defer signatureEncoder.Close()
signatureEncoder.Write(signatureBuffer.Bytes())
signatureEncoder.Close()
defer func(signatureEncoder io.WriteCloser) {
err := signatureEncoder.Close()
if err != nil {
panic(err)
}
}(signatureEncoder)
if _, err := signatureEncoder.Write(signatureBuffer.Bytes()); err != nil {
log.Fatal(err)
}
err = signatureEncoder.Close()
if err != nil {
log.Fatal(err)
}
if _, _, err := forgeClient.CreateGPGKey(forgejo.CreateGPGKeyOption{
ArmoredKey: publicKeyArmor,
@ -156,9 +163,7 @@ var daemonCmd = &cobra.Command{
}); err != nil {
log.Fatal(err)
}
pgpEntity = OpenPGPEntity{
Entity: entity,
}
pgpEntity = entity
} else {
log.Fatal(err)
}
@ -177,9 +182,7 @@ var daemonCmd = &cobra.Command{
log.Fatal("invalid keyring")
}
pgpEntity = OpenPGPEntity{
Entity: el[0],
}
pgpEntity = el[0]
}
appConfig := fiber.Config{
@ -297,7 +300,7 @@ func handlePush(c *fiber.Ctx, forgeClient *forgejo.Client, event *interfaces.For
return c.SendStatus(fiber.StatusOK)
}
func handleIssues(c *fiber.Ctx, forgeClient *forgejo.Client, event *interfaces.ForgejoIssueEvent, entity OpenPGPEntity, user *forgejo.User) error {
func handleIssues(c *fiber.Ctx, forgeClient *forgejo.Client, event *interfaces.ForgejoIssueEvent, entity *openpgp.Entity, user *forgejo.User) error {
if event.Action == "opened" && event.Issue.Title == "setup:goscan" {
if _, err := forgeClient.CreateRepoActionSecret(event.Issue.Repo.Owner, event.Issue.Repo.Name, forgejo.CreateSecretOption{
Name: "goscan_token",
@ -346,7 +349,7 @@ func handleIssues(c *fiber.Ctx, forgeClient *forgejo.Client, event *interfaces.F
return c.SendStatus(fiber.StatusInternalServerError)
}
if err := os.MkdirAll(gitDir+"/.forgejo/workflows", 0775); err != nil {
if err := os.MkdirAll(gitDir+"/.forgejo/workflows", 0775); /* #nosec G301 */ err != nil {
log.Error(err)
return c.SendStatus(fiber.StatusInternalServerError)
}
@ -375,7 +378,7 @@ func handleIssues(c *fiber.Ctx, forgeClient *forgejo.Client, event *interfaces.F
return c.SendStatus(fiber.StatusInternalServerError)
}
if err := os.WriteFile(gitDir+"/.forgejo/workflows/gosec.yml", []byte(tmplBuffer.String()), 0666); err != nil {
if err := os.WriteFile(gitDir+"/.forgejo/workflows/gosec.yml", []byte(tmplBuffer.String()), 0666); /* #nosec G306 */ err != nil {
log.Error(err)
return c.SendStatus(fiber.StatusInternalServerError)
}
@ -392,7 +395,7 @@ func handleIssues(c *fiber.Ctx, forgeClient *forgejo.Client, event *interfaces.F
}
if _, err := worktree.Commit("Add GoScan action", &git.CommitOptions{
SignKey: entity.Entity,
SignKey: entity,
Author: signature,
Committer: signature,
}); err != nil {