Consider using Betterleaks instead of Gitleaks

[zricethezav]

Problem or use case

Hey folks, I'm the author of Gitleaks and noticed entire uses gitleaks in a few spots. In case you missed it, I recently switched my focus to a new project called Betterleaks which is a drop-in replacement for Gitleaks.

https://github.com/betterleaks/betterleaks

I'll continue to do the bare minimum security maintenance on Gitleaks, but no new features and no new rules will be added to Gitleaks.

Happy to answer any questions or help in anyway.

Desired behavior

n/a

Proposed solution

No response

Alternatives or workarounds

No response

[peyton-alt]

Thanks for filing this! We've seen it and it's on our radar. We'll update this issue as we investigate.

[Soph]

@zricethezav thanks again for flagging this to us. I merged @peyton-alt PR today but just had to revert it. The issue is that in config.go betterleaks is overriding a few git related env variables:

https://github.com/betterleaks/betterleaks/blob/a243afa641f3da8348b44506b88bc32c04853043/config/config.go#L30-L44

We need those because entire is also pushing entire/checkpoints/v1 during a regular git push and that fails now if you use https since GIT_CONFIG_GLOBAL is pointing to /dev/null and this means we can't figure out the credential helper anymore.

I tried a few things but basically we would need something that let's us skip the override in config.go and only apply it when we actually do the secret scanning (and would setup a dedicated environment for that then). Maybe something like an exported function like config.SetGitEnv() that consumers call explicitly instead of it running at import time. Are you open for us opening a PR with that? Or do you have a different solution you would prefer?