ports/security/py-detect-secrets, branch 2023Q4

all: remove explicit versions in USES=python for "3.x+"

2023-06-27T19:34:34Z

The logic in USES=python will automatically convert this to 3.8+ by itself. Adjust two ports that only had Python 3.7 mentioned but build fine on Python 3.8 too. finance/quickfix: mark BROKEN with PYTHON libtool: compile: c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++ -DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable -Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong -fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi -Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings -Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x -MT _quickfix_la-QuickfixPython.lo -MD -MP -MF .deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp -fPIC -DPIC -o .libs/_quickfix_la-QuickfixPython.o warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean '-Wno-uninitialized'? [-Wunknown-warning-option] QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found ^~~~~~~~~~ 1 warning and 1 error generated. Reviewed by: portmgr, vishwin, yuri Differential Revision:

security/py-detect-secrets: Add py-detect-secrets 1.4.0

2023-04-05T17:29:40Z

detect-secrets is an aptly named module for (surprise, surprise) detecting secrets within a code base. However, unlike other similar packages that solely focus on finding secrets, this package is designed with the enterprise client in mind: providing a backwards compatible, systematic means of: 1. Preventing new secrets from entering the code base, 2. Detecting if such preventions are explicitly bypassed, and 3. Providing a checklist of secrets to roll, and migrate off to a more secure storage. This way, you create a separation of concern: accepting that there may currently be secrets hiding in your large repository (this is what we refer to as a baseline), but preventing this issue from getting any larger, without dealing with the potentially gargantuan effort of moving existing secrets away. It does this by running periodic diff outputs against heuristically crafted regex statements, to identify whether any new secret has been committed. This way, it avoids the overhead of digging through all git history, as well as the need to scan the entire repository every time.