Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package trufflehog for openSUSE:Factory checked in at 2026-10-10 14:59:26 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/trufflehog (Old) and /work/SRC/openSUSE:Factory/.trufflehog.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "trufflehog" Sat Oct 10 14:59:26 2026 rev:137 rq:1383886 version:3.99.2 Changes: -------- --- /work/SRC/openSUSE:Factory/trufflehog/trufflehog.changes 2026-10-07 19:36:39.533833611 +0200 +++ /work/SRC/openSUSE:Factory/.trufflehog.new.3698736/trufflehog.changes 2026-10-10 15:00:05.265758113 +0200 @@ -1,0 +2,11 @@ +Fri Oct 09 05:02:39 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 3.99.2: + * Copy over dedupe cache size into the engine from the config in + #5402 +- Update to version 3.99.1: + * [INT-1084] Make the results deduplication cache size + configurable (#5399) + * Update github-actions (#5363) + +------------------------------------------------------------------- Old: ---- trufflehog-3.99.0.obscpio New: ---- trufflehog-3.99.2.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ trufflehog.spec ++++++ --- /var/tmp/diff_new_pack.k8C7l3/_old 2026-10-10 15:00:09.939953792 +0200 +++ /var/tmp/diff_new_pack.k8C7l3/_new 2026-10-10 15:00:09.945954044 +0200 @@ -17,7 +17,7 @@ Name: trufflehog -Version: 3.99.0 +Version: 3.99.2 Release: 0 Summary: CLI tool to find exposed secrets in source and archives License: AGPL-3.0-or-later AND MPL-2.0 AND LGPL-3.0-or-later ++++++ _service ++++++ --- /var/tmp/diff_new_pack.k8C7l3/_old 2026-10-10 15:00:10.032957686 +0200 +++ /var/tmp/diff_new_pack.k8C7l3/_new 2026-10-10 15:00:10.041958063 +0200 @@ -2,7 +2,7 @@ <service name="obs_scm" mode="manual"> <param name="url">https://github.com/trufflesecurity/trufflehog.git</param> <param name="scm">git</param> - <param name="revision">refs/tags/v3.99.0</param> + <param name="revision">refs/tags/v3.99.2</param> <param name="match-tag">v*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.k8C7l3/_old 2026-10-10 15:00:10.106960784 +0200 +++ /var/tmp/diff_new_pack.k8C7l3/_new 2026-10-10 15:00:10.120961370 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/trufflesecurity/trufflehog.git</param> - <param name="changesrevision">b2b0a92070f206ab7b5a1105d82a7f2f48d92341</param></service></servicedata> + <param name="changesrevision">e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9</param></service></servicedata> (No newline at EOF) ++++++ trufflehog-3.99.0.obscpio -> trufflehog-3.99.2.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trufflehog-3.99.0/.github/workflows/codeql-analysis.yml new/trufflehog-3.99.2/.github/workflows/codeql-analysis.yml --- old/trufflehog-3.99.0/.github/workflows/codeql-analysis.yml 2026-10-06 19:41:22.000000000 +0200 +++ new/trufflehog-3.99.2/.github/workflows/codeql-analysis.yml 2026-10-08 15:52:09.000000000 +0200 @@ -45,7 +45,7 @@ go-version: "1.27" # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -56,4 +56,4 @@ run: | go build . - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trufflehog-3.99.0/.github/workflows/detector-corpora-test.yml new/trufflehog-3.99.2/.github/workflows/detector-corpora-test.yml --- old/trufflehog-3.99.0/.github/workflows/detector-corpora-test.yml 2026-10-06 19:41:22.000000000 +0200 +++ new/trufflehog-3.99.2/.github/workflows/detector-corpora-test.yml 2026-10-08 15:52:09.000000000 +0200 @@ -108,7 +108,7 @@ - name: Configure AWS credentials if: steps.detect.outputs.any_changed == 'true' - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6 with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trufflehog-3.99.0/.github/workflows/release.yml new/trufflehog-3.99.2/.github/workflows/release.yml --- old/trufflehog-3.99.0/.github/workflows/release.yml 2026-10-06 19:41:22.000000000 +0200 +++ new/trufflehog-3.99.2/.github/workflows/release.yml 2026-10-08 15:52:09.000000000 +0200 @@ -22,7 +22,7 @@ with: fetch-depth: 0 - name: Set up QEMU - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4 - name: Docker Login to DockerHub uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trufflehog-3.99.0/.github/workflows/test.yml new/trufflehog-3.99.2/.github/workflows/test.yml --- old/trufflehog-3.99.0/.github/workflows/test.yml 2026-10-06 19:41:22.000000000 +0200 +++ new/trufflehog-3.99.2/.github/workflows/test.yml 2026-10-08 15:52:09.000000000 +0200 @@ -48,7 +48,7 @@ secret: ${{ secrets.BUILDPULSE_SECRET_ACCESS_KEY }} tags: integration - name: Annotate test results - uses: mikepenz/action-junit-report@a9170d5795813c01ab4901ffb045b52bab4ab09d # v6 + uses: mikepenz/action-junit-report@b7b80d7ac5b1da46d6aaff9fb57ad50d8453bcb3 # v6 if: success() || failure() # always run even if the previous step fails with: report_paths: "tmp/test-results/*.xml" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trufflehog-3.99.0/docs/man/trufflehog.1 new/trufflehog-3.99.2/docs/man/trufflehog.1 --- old/trufflehog-3.99.0/docs/man/trufflehog.1 2026-10-06 19:41:22.000000000 +0200 +++ new/trufflehog-3.99.2/docs/man/trufflehog.1 2026-10-08 15:52:09.000000000 +0200 @@ -50,6 +50,9 @@ \fB--results=RESULTS\fR Specifies which type(s) of results to output: verified (confirmed valid by API), unknown (verification failed due to error), unverified (detected but not verified), filtered_unverified (unverified but would have been filtered out). Defaults to verified,unverified,unknown. .TP +\fB--deduplication-cache-size=5000\fR +Max size of the results deduplication cache, setting to 0 disables +.TP \fB--no-color\fR Disable colorized output .TP diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trufflehog-3.99.0/main.go new/trufflehog-3.99.2/main.go --- old/trufflehog-3.99.0/main.go 2026-10-06 19:41:22.000000000 +0200 +++ new/trufflehog-3.99.2/main.go 2026-10-08 15:52:09.000000000 +0200 @@ -60,8 +60,13 @@ noVerification = cli.Flag("no-verification", "Don't verify the results.").Bool() onlyVerified = cli.Flag("only-verified", "Only output verified results.").Hidden().Bool() results = cli.Flag("results", "Specifies which type(s) of results to output: verified (confirmed valid by API), unknown (verification failed due to error), unverified (detected but not verified), filtered_unverified (unverified but would have been filtered out). Defaults to verified,unverified,unknown.").String() - noColor = cli.Flag("no-color", "Disable colorized output").Bool() - noColour = cli.Flag("no-colour", "Alias for --no-color").Hidden().Bool() + + // The default cache size is 5000 entries, which is a balance between memory usage and the need for effective deduplication. + // Since the cache entries are md5 hashes so each entry would be 16 bytes, so in total this would be aorund 80KB of memory usage. + dedupeCacheSize = cli.Flag("deduplication-cache-size", "Max size of the results deduplication cache, setting to 0 disables").Default("5000").Int() + + noColor = cli.Flag("no-color", "Disable colorized output").Bool() + noColour = cli.Flag("no-colour", "Alias for --no-color").Hidden().Bool() allowVerificationOverlap = cli.Flag("allow-verification-overlap", "Allow verification of similar credentials across detectors").Bool() filterUnverified = cli.Flag("filter-unverified", "Only output first unverified result per chunk per detector if there are more than one results.").Bool() @@ -669,6 +674,7 @@ ShouldScanEntireChunk: *scanEntireChunk, MaxDecodeDepth: *maxDecodeDepth, VerificationCacheMetrics: &verificationCacheMetrics, + DedupeCacheSize: *dedupeCacheSize, } if !*noVerificationCache { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trufflehog-3.99.0/pkg/engine/engine.go new/trufflehog-3.99.2/pkg/engine/engine.go --- old/trufflehog-3.99.0/pkg/engine/engine.go 2026-10-06 19:41:22.000000000 +0200 +++ new/trufflehog-3.99.2/pkg/engine/engine.go 2026-10-08 15:52:09.000000000 +0200 @@ -179,6 +179,9 @@ // 1 = single pass (no chaining), 2+ = chained (e.g., base64 inside UTF-16). // Default: 5. MaxDecodeDepth int + + // Max size of the deduplication LRU cache + DedupeCacheSize int } // Engine represents the core scanning engine responsible for detecting secrets in input data. @@ -252,6 +255,8 @@ maxDecodeDepth int + dedupeCacheSize int + // runtimeCollector exposes live channel/worker/scan counters to Prometheus // while the engine is running. Set in Start, cleared in Finish. runtimeCollector *runtimeCollector @@ -281,6 +286,7 @@ notificationWorkerMultiplier: cfg.NotificationWorkerMultiplier, verificationOverlapWorkerMultiplier: cfg.VerificationOverlapWorkerMultiplier, maxDecodeDepth: cfg.MaxDecodeDepth, + dedupeCacheSize: cfg.DedupeCacheSize, } if engine.sourceManager == nil { return nil, fmt.Errorf("source manager is required") @@ -569,14 +575,15 @@ // deduplication efforts, allowing the engine to quickly check if a chunk has // been processed before, thereby saving computational overhead. func (e *Engine) initialize(ctx context.Context) error { - // The cache size is set to 5000 entries, which is a balance between memory usage and the need for effective deduplication. - // Since the cache entries are md5 hashes so each entry would be 16 bytes, so in total this would be aorund 80KB of memory usage. - const cacheSize = 5000 + if e.dedupeCacheEnabled() { + cache, err := lru.New[string, struct{}](e.dedupeCacheSize) + if err != nil { + return fmt.Errorf("failed to initialize LRU cache: %w", err) + } - cache, err := lru.New[string, struct{}](cacheSize) - if err != nil { - return fmt.Errorf("failed to initialize LRU cache: %w", err) + e.dedupeCache = cache } + const ( // detectableChunksChanMultiplier is set to accommodate a high number of concurrent worker goroutines. // This multiplier ensures that the detectableChunksChan channel has sufficient buffer capacity @@ -600,7 +607,6 @@ chan verificationOverlapChunk, defaultChannelBuffer*verificationOverlapChunksChanMultiplier, ) e.results = make(chan detectors.ResultWithMetadata, defaultChannelBuffer*resultsChanMultiplier) - e.dedupeCache = cache ctx.Logger().V(4).Info("engine initialized") // Configure the EntireChunkSpanCalculator if the engine is set to scan the entire chunk. @@ -616,6 +622,10 @@ return nil } +func (e *Engine) dedupeCacheEnabled() bool { + return e.dedupeCacheSize > 0 +} + const ignoreTag = "trufflehog:ignore" // AhoCorasickCoreKeywords returns a set of keywords that the engine's @@ -1410,7 +1420,7 @@ // result from reverification and want to Dispatch it below. // Notifier workers share this cache; the check and insert must be one atomic step. - if result.SecretID == 0 { + if e.dedupeCacheEnabled() && result.SecretID == 0 { h := md5.Sum([]byte(fmt.Sprintf("%s%s%s%s%+v", result.DetectorName, result.DetectorType.String(), result.Raw, result.RawV2, result.SourceMetadata))) key := string(h[:]) if found, _ := e.dedupeCache.ContainsOrAdd(key, struct{}{}); found { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/trufflehog-3.99.0/pkg/engine/engine_test.go new/trufflehog-3.99.2/pkg/engine/engine_test.go --- old/trufflehog-3.99.0/pkg/engine/engine_test.go 2026-10-06 19:41:22.000000000 +0200 +++ new/trufflehog-3.99.2/pkg/engine/engine_test.go 2026-10-08 15:52:09.000000000 +0200 @@ -2295,6 +2295,7 @@ notifyVerifiedResults: true, notifyUnverifiedResults: true, notifyUnknownResults: true, + dedupeCacheSize: 5000, } result := detectors.ResultWithMetadata{ @@ -2352,6 +2353,7 @@ notifyVerifiedResults: true, notifyUnverifiedResults: true, notifyUnknownResults: true, + dedupeCacheSize: 5000, } // Fill and close the channel before starting workers so they all contend ++++++ trufflehog.obsinfo ++++++ --- /var/tmp/diff_new_pack.k8C7l3/_old 2026-10-10 15:00:13.233091655 +0200 +++ /var/tmp/diff_new_pack.k8C7l3/_new 2026-10-10 15:00:13.243092074 +0200 @@ -1,5 +1,5 @@ name: trufflehog -version: 3.99.0 -mtime: 1791308482 -commit: b2b0a92070f206ab7b5a1105d82a7f2f48d92341 +version: 3.99.2 +mtime: 1791467529 +commit: e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/trufflehog/vendor.tar.gz /work/SRC/openSUSE:Factory/.trufflehog.new.3698736/vendor.tar.gz differ: char 136, line 1
