Executable tutorial proposal (lvainio)

[lvainio]

Assignment Proposal

Title

SAST in go using gosec

Names and KTH ID

• Leo Vainio ([email protected])
• Wenqi Cao ([email protected])

Deadline

• Task 2

Category

• Executable Tutorial

Description

To make the tutorial I will use Killercoda. Gosec is a security scanner for the go language which identifies common vulnerabilities. My idea is to create a mock project in go that contains some vulnerabilities and then show in the tutorial how gosec can be used to identify these vulnerabilities. I will show how gosec is installed and will give some different examples on how to use it. I might also show how it can be integrated with GitHub Actions.

Relevance

Detecting vulnerabilities as soon as new code is commited to the code base is great since it is often easier and cheaper to fix these issues when they are found early. Scanning the source code for known vulnerabilities, which is what gosec does, is one way to detect security issues early on. Having security integrated in the DevOps workflow also alleviates the potential bottleneck of having a completely separate security team having to review each new update, which could delay deployment.

[sofiabobadilla]

Hi!
The proposal is interesting, but you are missing one crucial things:
Find a partner, all tasks must be performed in pairs.

[lvainio]

Was it not possible to do 2 tasks alone? I remember reading that

[sofiabobadilla]

It is not possible to do any task alone. Please find a partner.

[lvainio]

We have updated the pull request now!

[sofiabobadilla]

Wonderful!
Thank you both 😄

I'll merge now.

[DavidCWQ]

Hi @sofiabobadilla, I just want a double check. Shall I change the folder name to include my KTH ID as lvainio-wenqic?

[sofiabobadilla]

Yes please :)

[DavidCWQ]

Hi @sofiabobadilla ,

I encountered an error while creating pull-request for renaming the folder to lvainio-wenqic.

What should I do next?

Here’s the traceback:

Traceback (most recent call last):
  File "/home/runner/work/devops-course/devops-course/./canvas-code/update_task.py", line 188, in <module>
    main()
  File "/home/runner/work/devops-course/devops-course/./canvas-code/update_task.py", line 181, in main
    check_groups(canvas_groups_category_id, task_name, github_groups)
  File "/home/runner/work/devops-course/devops-course/./canvas-code/update_task.py", line 92, in check_groups
    raise Exception("User {0} already registered for {1} !".format(member, task_name))
Exception: User lvainio already registered for executable-tutorial!

Here's the complete error message:

Run export PYTHONPATH="$PWD/canvas-code/utils"
Traceback (most recent call last):
Getting tasks : executable-tutorial
  File "/home/runner/work/devops-course/devops-course/./canvas-code/update_task.py", line 188, in <module>
    main()
TASK_NAME executable-tutorial
  File "/home/runner/work/devops-course/devops-course/./canvas-code/update_task.py", line 181, in main
    check_groups(canvas_groups_category_id, task_name, github_groups)
  File "/home/runner/work/devops-course/devops-course/./canvas-code/update_task.py", line 92, in check_groups
    raise Exception("User {0} already registered for {1} !".format(member, task_name))
Exception: User lvainio already registered for executable-tutorial !
CANVAS_GROUPS_SET {'Presentations': 277[12](https://github.com/KTH/devops-course/actions/runs/11029753015/job/30632871077?pr=2538#step:6:13), 'Scientific Papers': 27713, 'Demos': 27714, 'Open-source contributions': 27715, 'Executable Tutorials': 27716, 'Feedback': 27717, 'Student groups': 28584}
https://canvas.kth.se/api/v1/group_categories/277[16](https://github.com/KTH/devops-course/actions/runs/11029753015/job/30632871077?pr=2538#step:6:17)/groups?per_page=200
{'Authorization': '***'}
Error: Process completed with exit code 1.

[sofiabobadilla]

we are trying to fix it now.
I'll let you know how it goes.

[sofiabobadilla]

Solved.
Thank you @algomaster99 :)

[DavidCWQ]

Thank you sofiabobadilla & algomaster99!