diff options
Diffstat (limited to 'scripts/leak-check')
| -rwxr-xr-x | scripts/leak-check | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/scripts/leak-check b/scripts/leak-check index fbbd5d5..1a27eec 100755 --- a/scripts/leak-check +++ b/scripts/leak-check @@ -13,7 +13,8 @@ # Keep that file outside the repository so the list is never published. # # A line matching the regex in `git config krino.leakallow` is never -# reported (for example a public contact address in the README). +# reported (for example a second address of your own). krino's own public +# contact address is exempt from the address check without any such setting. # # Prints file:line for each hit, never the matched text, so a hit on a # private pattern does not echo the secret. Exits 0 when clean, 1 when @@ -24,13 +25,22 @@ set -eu cd "$(git rev-parse --show-toplevel)" allow=$(git config --get krino.leakallow || true) +# krino's own contact address, published on purpose in README and About. +# Exempt from the address check only, so any clone's `make ci` is clean. +public='contact@labunix\.xyz' +exempt= hits=0 # check LABEL GREP-ARGS...: report staged lines that match, as file:line. +# $exempt, when set, widens $allow for this one call. check() { label=$1 shift - out=$(git grep --cached -n -I "$@" | { if [ -n "$allow" ]; then grep -v -E -i -e "$allow"; else cat; fi; } | cut -d: -f1,2 || true) + filter=$allow + if [ -n "$exempt" ]; then + filter=${filter:+$filter|}$exempt + fi + out=$(git grep --cached -n -I "$@" | { if [ -n "$filter" ]; then grep -v -E -i -e "$filter"; else cat; fi; } | cut -d: -f1,2 || true) if [ -n "$out" ]; then printf 'leak-check: %s:\n%s\n' "$label" "$out" | sed '2,$s/^/ /' >&2 hits=1 @@ -42,7 +52,9 @@ if [ -n "$home" ]; then check "your home directory ($home)" -F -e "$home" -- . fi +exempt=$public check "an email address" -E -e '[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}' -- . ':(exclude)LICENSE' +exempt= list=$(git config --type=path --get krino.leakpatterns || true) if [ -z "$list" ]; then |