Introduce seekret

[jcscottiii]

This PR introduces Git-Seekret

• Installs git-seekret from source
  • Installs Go
  • Installs LibGit2
• Sets up templateDir

Setup of git-seekret per repo cases covered

• After checkout / clone or repos.
• For existing repos
• Sets up pre-commit hook

Rules enabled

• Mandrill Username, Password
• AWS ID, Key, Secret
• New Relic license key

Screenshot of the after clone case

Gotchas:
To ensure reliable of installation of git-seekret there are some options that need to happen, either:

• Git-seekret needs to vendor / pin their dependencies or,
• Git-seekret needs to create releases

UX of it catching an error:

$ echo "password = 'this is super secret'" > new_file
$ git add new_file
$ git commit
Found Secrets: 1
        new_file:1
            - Metadata:
              status: test
            - Rule:
              password.password
            - Content:
              password = 'this is super secret'

Before merge read #69 (comment) 👀

• Update https://github.com/18F/laptop/blob/seekret/mac#L238 to reference master
• Update https://github.com/18F/laptop/blob/seekret/seekrets-install#L55 to reference master
• Promote the branch names to master from seekret #118

[rogeruiz]

@alain-hoang This would be a good place to have standup although it'll be a little like talking into the void. But raise any concerns, questions, comments, funny memes 😉 in here and we can triage them with other engineers intrested in helping out. 👍

[rogeruiz]

👀 look at the tests failure here. @alain-hoang

[alain-hoang]

See #83 for more information on these failures

[monfresh]

Just leaving a reminder here to change the path to point to master before merging.

[monfresh]

LGTM. I was able to install it and running git seekret check -c 0 against the identity-idp repo found no offenses, after Roger fixed the aws.rule regex.

[rogeruiz]

Waiting on the last test results to pass then I'll be merging in #118 into #69 and then #69 into master. 🎉 thanks everyone! 🙇

[konklone]

How difficult would this be to extract from the laptop repository? We also would want to use this on potential Linux environments, and it'd be nice to make it reusable by others (and garner contributions from others) who aren't using our laptop configuration system.

[rogeruiz]

@konklone not very difficult at all. The main repository for git-seekret is forked here and the main lib for that is forked here. @LinuxBozo had tried getting Linux support out of the box but assumptions about curl were made and need to be revisited.

To extract the installation from this repo, we would just need to move a few things:

• the git-seekret documentation
• seekrets-install script
  • modify the install script to point to a new location that isn't the 18F/laptop repository for downloading / reading the rulesets and the installation script itself.
• seekret-rules/*.rule rule files
• the BATS tests test directory

[rogeruiz]

Conversation moved to 18F/git-seekret#11