-
-
Notifications
You must be signed in to change notification settings - Fork 89
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Is it possible to remove test data keys from the image build to avoid container security scanning alerts? #40
Comments
thanks. can you share me the scan report? If the scan tool is open source, I can run the scan to have a look first. |
Hi @ozbillwang - Happy New Year! :) We are using a commercial tool called Snyk which does not report the presence of these keys as vulnerabilities. However we have two clients who have both flagged the presence of these keys as vulnerabilities. I will ask which security scanning tools they use, but I expect them to be commercial. We deploy a lot of containers with open source software and none appear to have key files present inn them. Thanks! |
I did see these files with others under path of
|
Get help from openai directly :-), not sure if this answer is good enough |
Noble use of OpenAI, but you asked the wrong question. You asked:
when you should have asked
Except the AI still answers wrongly... This caused issue #44 |
alpine-k8s:1.23.14 contains four keys under a testdata directory:
/root/.local/share/helm/plugins/helm-push/testdata/tls/server.key
/root/.local/share/helm/plugins/helm-push/testdata/tls/client.key
/root/.cache/helm/plugins/https-github.com-chartmuseum-helm-push/testdata/tls/client.key
/root/.cache/helm/plugins/https-github.com-chartmuseum-helm-push/testdata/tls/server.key
Is it possible to modify future builds so these keys are not present?
While I understand they do not represent a security risk, they tend to come up as high severity issues during container security scanning which causes lots of effort around arranging exceptions with InfoSec.
Thanks! :)
The text was updated successfully, but these errors were encountered: