Opengrep quickstart

Since I could not find a quickstart to run opengrep with the full set of rules from their fork I thought I'd document what I found out.

Setup

Download the opengrep binary from github and make it executable with chmod +x.
Clone the rules repo:
git clone git@github.com:opengrep/opengrep-rules.git

and clean it up to make it usable to opengrep:
cd opengrep-rules
rm -rf ".git",".github",".pre-commit-config.yaml", "elixir", "apex"
find . -type f -not -iname "*.yaml" -delete
rm -rf .github
rm -rf .pre-commit-config.yaml

Ensure opengrep can load the rules with:
opengrep_manylinux_x86 validate .

The same can be done for custom rules maintained in a separate repository. AFAIU Multiple repositories can be specified by repeating -f option as needed, see below.

We are now ready to scan a repo, from the repo root directory run:
opengrep_manylinux_x86 scan \
  -f <path_to>/opengrep-rules \
  --error \
  --exclude-rule=VAL

some tips:
  1. to save time you can load only the rules that apply to a specific project, for example only load java rules and ignore everything else by repeating -f with specific subdirectories
  2. output can redirected to a file in a specific format for later inspection, loading into defectdojo or archival with --text-* options
  3. --exclude-rules can be used to disable rules and can be repeated as many times as necessary
  4. --error forces opengrep to exit with 1 if there are any findings, useful for CI
  5. --include and --exclude can be used to exclude files and directories that are not relevant
Run opengrep --help to see all options.

Running opengrep against recent changes only

We can gather a list of changed files (in this case files changed less than 72h ago) and supply that list to opengrep with some bash magic:
find . \
  -type f \
  -atime -72 \
  -print0 \
  | xargs \
    --no-run-if-empty \
    -0 <opegrep command>

Note that if the list becomes longer than 1024 files approx., xargs will start another opengrep process after the first one.

Additional rules


Popular posts

Using LLMs at Oxide

Once again , some supremely well-thought and useful content from Oxide:  https://rfd.shared.oxide.computer/rfd/0576 This time it is about the use of LLMs within Oxide , here are my main take aways: start from values ! A phenomenal example of how values can be so much more than the vanity checklist that most companies use them for focus on the receiving end : why should I spend time reading something that the author did not think was worth enough spending the necessary time to write it? Again, goes back to their strongly writing-oriented culture and values corollary of item number 2: self review AI-generated code before asking others to review it!
Read more

How to automatically import a ZFS pool built on top of iSCSI devices with systemd

When using ZFS on top of iSCSI devices one needs to deal with the fact that iSCSI devices usually appear late in the boot process. ZFS on the other hand is loaded early and the iSCSI devices are not present at the time ZFS scans available devices for pools to import. This means that not all ZFS pools might be imported after the system has completed boot, even if the underlying devices are present and functional. A quick and dirty solution would be to run  zpool import <poolname> after boot, either manually or from cron. A better, more elegant solution is instead to hook into systemd events and trigger zpool import as soon as the devices are created.
Read more