Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 18 Packages Projects Releases Wiki Activity
Files
main
fleet/security/code/trivy-secret.yaml
T
Luke Heath a2908f4098 Cherry-pick #48451: Adding changes for Fleet v4.89.0 (#49379) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** NA

Cherry-pick of #48451 ("Adding changes for Fleet v4.89.0") from
`rc-minor-fleet-v4.89.0` into `main`.

This brings the v4.89.0 CHANGELOG entry and the corresponding `changes/`
cleanup into main. The CHANGELOG conflict was resolved by placing the
4.89.0 section above the existing 4.88.1 section (keeping main's 4.88.1
date of Jul 10, 2026).

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added vulnerability filtering by CVSS score and exploitability in
Fleet Desktop.
  * Added default enrollment behavior for fleet-owned Apple devices.
* Added additional filtering options to the Vulnerability Exposure
chart.
* Improved certificate template variables, including IdP values and host
platform.

* **Bug Fixes**
* Fixed policy selection pagination, stale policy/report details, and
missing-host reporting.
* Corrected SSO and email links when Fleet is hosted under a URL
subpath.
  * Improved Windows profile validation and MDM command labeling.
* Fixed several display and accessibility issues, including host counts,
checkbox wording, and dark-mode badges.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-07-16 11:55:43 -07:00

102 lines
4.7 KiB
YAML
Raw Permalink Blame History

# Trivy secret scanning configuration.
# Docs: https://trivy.dev/docs/latest/scanner/secret/
#
# Every suppressed file is listed explicitly. Production files also require
# a content-specific regex so new real secrets in the same file still trigger.
allow-rules:
# ---- Test/dev private keys and TLS certs (not production) ----
- id: test-key-osquery-iab
path: ^tools/osquery/in-a-box/osquery/fleet.key$
- id: test-key-osquery
path: ^tools/osquery/fleet.key$
- id: test-key-smtp4dev
path: ^tools/smtp4dev/fleet.key$
- id: test-key-orbit-mtls
path: ^tools/test-orbit-mtls/client.key$
- id: test-key-intermediate-ca
path: ^tools/test-certs/intermediate-ca/intermediate.key.pem$
- id: test-key-root-ca
path: ^tools/test-certs/root-ca/root-ca.key.pem$
- id: test-key-server-cert
path: ^tools/test-certs/server/server.key.pem$
- id: test-key-upgrade
path: ^tools/upgrade/fleet.key$
- id: test-key-service-testdata
path: ^server/service/testdata/client.key$
- id: test-key-cryptoutil-rsa
path: ^server/mdm/cryptoutil/testdata/pkcs8-rsa.key$
- id: test-key-cryptoutil-x25519
path: ^server/mdm/cryptoutil/testdata/pkcs8-x25519.key$
- id: test-key-certificate
path: ^pkg/certificate/testdata/test.key$
- id: test-key-client-testdata
path: ^client/testdata/client.key$
- id: test-key-insecure-proxy
path: ^orbit/pkg/insecure/proxy.go$
- id: test-key-httpsigproxy
path: ^ee/orbit/pkg/httpsigproxy/httpsigproxy.go$
# ---- Production files (path + content-specific regex) ----
- id: serve-dev-license-jwts
description: "Hardcoded dev/expired license JWTs for --dev_license flag"
path: "^cmd/fleet/serve\\.go$"
regex: "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9\\."
- id: calendars-gcp-placeholder
description: "GCP service account JSON placeholder shown in the UI"
path: "^frontend/pages/admin/IntegrationsPage/cards/Calendars/Calendars\\.tsx$"
regex: "fleet-in-your-calendar"
- id: google-workspace-gcp-placeholder
description: "GCP service account JSON placeholder shown in the UI"
path: "^frontend/pages/admin/IntegrationsPage/cards/IdentityProviders/components/GoogleWorkspaceSection/GoogleWorkspaceSection\\.tsx$"
regex: "fleet-idp-sync"
- id: sails-fake-stripe-website
description: "Placeholder Stripe keys in website Sails config"
path: "^(website/config/custom\\.js|website/config/env/production\\.js|website/config/env/staging\\.js|website/views/pages/faq\\.ejs)$"
regex: "(sk_test_Zzd814|pk_test_Zzd814|sk_prod__fake_Nfgh|sk_sandbox__fake_Nfgh|pk_sandbox__fake_fKd3)"
- id: sails-fake-stripe-agent-downloader
description: "Placeholder Stripe keys in fleet-agent-downloader Sails config"
path: "^(ee/fleet-agent-downloader/config/custom\\.js|ee/fleet-agent-downloader/config/env/production\\.js|ee/fleet-agent-downloader/config/env/staging\\.js)$"
regex: "(sk_test_Zzd814|pk_test_Zzd814|sk_prod__fake_Nfgh|sk_sandbox__fake_Nfgh|pk_sandbox__fake_fKd3)"
- id: sails-fake-stripe-vuln-dashboard
description: "Placeholder Stripe keys in vulnerability-dashboard Sails config"
path: "^(ee/vulnerability-dashboard/config/custom\\.js|ee/vulnerability-dashboard/config/env/production\\.js|ee/vulnerability-dashboard/config/env/staging\\.js|ee/vulnerability-dashboard/views/pages/homepage\\.ejs|ee/vulnerability-dashboard/views/pages/faq\\.ejs|ee/vulnerability-dashboard/assets/js/utilities/open-stripe-checkout\\.js)$"
regex: "(sk_test_Zzd814|pk_test_Zzd814|pk_test_Qz5RfD|sk_prod__fake_Nfgh|sk_sandbox__fake_Nfgh|pk_sandbox__fake_fKd3)"
- id: sails-fake-sendgrid-website
description: "Placeholder SendGrid key in website Sails config"
path: "^(website/config/custom\\.js|website/config/env/production\\.js|website/config/env/staging\\.js|website/views/pages/faq\\.ejs)$"
regex: "SG\\.fake\\.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU"
- id: sails-fake-sendgrid-agent-downloader
description: "Placeholder SendGrid key in fleet-agent-downloader Sails config"
path: "^(ee/fleet-agent-downloader/config/custom\\.js|ee/fleet-agent-downloader/config/env/production\\.js|ee/fleet-agent-downloader/config/env/staging\\.js)$"
regex: "SG\\.fake\\.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU"
- id: sails-fake-sendgrid-vuln-dashboard
description: "Placeholder SendGrid key in vulnerability-dashboard Sails config"
path: "^(ee/vulnerability-dashboard/config/custom\\.js|ee/vulnerability-dashboard/config/env/production\\.js|ee/vulnerability-dashboard/config/env/staging\\.js|ee/vulnerability-dashboard/views/pages/homepage\\.ejs|ee/vulnerability-dashboard/views/pages/faq\\.ejs)$"
regex: "SG\\.fake\\.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU"
Reference in New Issue View Git Blame Copy Permalink