Documentation
¶
Overview ¶
Package trufflehog parses TruffleHog's --json output, which is JSONL (newline-delimited: one JSON finding object per line), into structured findings.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var CanonicalEmpty = []byte("[]")
CanonicalEmpty is the content crafted for a clean scan (zero findings). TruffleHog emits nothing when it finds no secrets, so there is no native empty document; storing this keeps a passing scan attestable and round-trips through Parse to an empty findings list. The crafter and Parse share this one definition so the write and read sides never drift.
Functions ¶
This section is empty.
Types ¶
type Finding ¶
type Finding struct {
SourceMetadata SourceMetadata `json:"SourceMetadata"`
SourceID int `json:"SourceID"`
SourceType int `json:"SourceType"`
SourceName string `json:"SourceName"`
DetectorType int `json:"DetectorType"`
DetectorName string `json:"DetectorName"`
DecoderName string `json:"DecoderName"`
Verified bool `json:"Verified"`
Raw string `json:"Raw"`
Redacted string `json:"Redacted"`
}
Finding is a single TruffleHog secret detection result (one JSONL line).
func Parse ¶
Parse reads TruffleHog output and returns its findings. It accepts two forms:
- JSONL: one JSON finding object per line (TruffleHog's native --json output).
- JSON array: a single "[...]" document. This is the canonical form we craft for a clean scan (TruffleHog emits nothing when it finds no secrets, so "[]" represents zero findings).
It errors if a non-blank line (JSONL) or the document (array) is not valid JSON. An input with no findings (empty, whitespace only, or "[]") yields an empty slice and no error; callers decide whether an empty report is acceptable.
type SourceMetadata ¶
type SourceMetadata struct {
Data json.RawMessage `json:"Data,omitempty"`
}
SourceMetadata mirrors the nested source information TruffleHog attaches to each finding. Only the fields needed for policy evaluation are decoded; the concrete source shape (Filesystem, Git, ...) varies per source type, so it is kept as a raw JSON message to preserve it verbatim without losing type safety on the fields we do read.
Source Files