You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
`$ go get github.com/securego/gas/cmd/gas/...`
20
+
`$ go get github.com/securego/gosec/cmd/gosec/...`
24
21
25
22
### Usage
26
23
27
-
Gas can be configured to only run a subset of rules, to exclude certain file
24
+
Gosec can be configured to only run a subset of rules, to exclude certain file
28
25
paths, and produce reports in different formats. By default all rules will be
29
26
run against the supplied input files. To recursively scan from the current
30
27
directory you can supply './...' as the input argument.
31
28
32
29
#### Selecting rules
33
30
34
-
By default Gas will run all rules against the supplied file paths. It is however possible to select a subset of rules to run via the '-include=' flag,
31
+
By default gosec will run all rules against the supplied file paths. It is however possible to select a subset of rules to run via the '-include=' flag,
35
32
or to specify a set of rules to explicitly exclude using the '-exclude=' flag.
36
33
37
34
##### Available rules
@@ -63,22 +60,22 @@ or to specify a set of rules to explicitly exclude using the '-exclude=' flag.
63
60
64
61
```
65
62
# Run a specific set of rules
66
-
$ gas -include=G101,G203,G401 ./...
63
+
$ gosec -include=G101,G203,G401 ./...
67
64
68
65
# Run everything except for rule G303
69
-
$ gas -exclude=G303 ./...
66
+
$ gosec -exclude=G303 ./...
70
67
```
71
68
72
69
#### Excluding files:
73
70
74
-
Gas will ignore dependencies in your vendor directory any files
71
+
gosec will ignore dependencies in your vendor directory any files
75
72
that are not considered build artifacts by the compiler (so test files).
76
73
77
74
#### Annotating code
78
75
79
-
As with all automated detection tools there will be cases of false positives. In cases where Gas reports a failure that has been manually verified as being safe it is possible to annotate the code with a '#nosec' comment.
76
+
As with all automated detection tools there will be cases of false positives. In cases where gosec reports a failure that has been manually verified as being safe it is possible to annotate the code with a '#nosec' comment.
80
77
81
-
The annotation causes Gas to stop processing any further nodes within the
78
+
The annotation causes gosec to stop processing any further nodes within the
82
79
AST so can apply to a whole block or more granularly to a single expression.
83
80
84
81
```go
@@ -102,26 +99,26 @@ have been used. To run the scanner and ignore any #nosec annotations you
102
99
can do the following:
103
100
104
101
```
105
-
$ gas -nosec=true ./...
102
+
$ gosec -nosec=true ./...
106
103
```
107
104
#### Build tags
108
105
109
-
Gas is able to pass your [Go build tags](https://golang.org/pkg/go/build/) to the analyzer.
106
+
gosec is able to pass your [Go build tags](https://golang.org/pkg/go/build/) to the analyzer.
110
107
They can be provided as a comma separated list as follows:
111
108
112
109
```
113
-
$ gas -tag debug,ignore ./...
110
+
$ gosec -tag debug,ignore ./...
114
111
```
115
112
116
113
### Output formats
117
114
118
-
Gas currently supports text, json, yaml, csv and JUnit XML output formats. By default
115
+
gosec currently supports text, json, yaml, csv and JUnit XML output formats. By default
119
116
results will be reported to stdout, but can also be written to an output
120
117
file. The output format is controlled by the '-fmt' flag, and the output file is controlled by the '-out' flag as follows:
121
118
122
119
```
123
120
# Write output in json format to results.json
124
-
$ gas -fmt=json -out=results.json *.go
121
+
$ gosec -fmt=json -out=results.json *.go
125
122
```
126
123
### Development
127
124
@@ -144,7 +141,7 @@ make test
144
141
145
142
#### Release Build
146
143
147
-
Gas can be released as follows:
144
+
gosec can be released as follows:
148
145
149
146
```bash
150
147
make release VERSION=2.0.0
@@ -153,11 +150,11 @@ make release VERSION=2.0.0
153
150
The released version of the tool is available in the `build` folder. The build information should be displayed in the usage text.
154
151
155
152
```
156
-
./build/gas-2.0.0-linux-amd64 -h
153
+
./build/gosec-2.0.0-linux-amd64 -h
157
154
158
-
GAS - Go AST Scanner
155
+
gosec - Golang security checker
159
156
160
-
Gas analyzes Go source code to look for common programming mistakes that
157
+
gosec analyzes Go source code to look for common programming mistakes that
161
158
can lead to security problems.
162
159
163
160
VERSION: 2.0.0
@@ -174,10 +171,10 @@ You can execute a release and build the docker image as follows:
174
171
make image VERSION=2.0.0
175
172
```
176
173
177
-
Now you can run the gas tool in a container against your local workspace:
174
+
Now you can run the gosec tool in a container against your local workspace:
178
175
179
176
```
180
-
docker run -it -v <YOUR LOCAL WORKSPACE>:/workspace gas /workspace
177
+
docker run -it -v <YOUR LOCAL WORKSPACE>:/workspace gosec /workspace
181
178
```
182
179
183
180
#### Generate TLS rule
@@ -188,7 +185,7 @@ The configuration of TLS rule can be generated from [Mozilla's TLS ciphers recom
188
185
First you need to install the generator tool:
189
186
190
187
```
191
-
go get github.com/securego/gas/cmd/tlsconfig/...
188
+
go get github.com/securego/gosec/cmd/tlsconfig/...
192
189
```
193
190
194
191
You can invoke now the `go generate` in the root of the project:
0 commit comments