Gerrit
7 min
gerrit edition enterprise only the gerrit integration scans projects in gerrit for credentials and other sensitive data configuration the gerrit integration can be configured in trufflehog under integrations , or via a local configuration file (below) trufflehog scans only the projects the configured credentials have access to web configuration configure this integration from the integrations page in trufflehog you'll need credentials for a gerrit account with read access to the projects you want to scan, or anonymous access if your gerrit instance allows it local configuration local configuration supports two authentication methods basic authentication — uses a gerrit account username and password unauthenticated — for gerrit instances that allow anonymous read access if projects is omitted, all projects the credential can list and access will be scanned basic authentication sources \ connection "@type" type googleapis com/sources gerrit endpoint https //gerrit example com basicauth username scanner account password xxxxxxxxxxxxxxxxxxxxxxxxxx name gerrit scanperiod 12h type source type gerrit verify true unauthenticated sources \ connection "@type" type googleapis com/sources gerrit endpoint https //gerrit example com unauthenticated {} name gerrit scanperiod 12h type source type gerrit verify true configuration options field type required description endpoint string yes the url endpoint for the gerrit service projects list no explicit list of projects to scan omit to enumerate instead skipbinaries boolean no skip binary files skiparchives boolean no skip archive files capabilities feature supported scan archive files ✅ scan base64 encoded data ✅ scan binaries ✅ history ✅ exclude filter ✅ auto resume ✅ notes trufflehog does not scan diffs larger than 1 gb troubleshooting error cause solution cannot process 'refs/remotes/origin/ ' and 'refs/remotes/origin/ ' at the same time repository contains refs that conflict on disk during clone (e g , a branch and a tag with overlapping paths) uncommon, but the scan will skip the affected repo and continue if you need to scan a repo that consistently throws this error, open a bug report for workaround guidance
