Skip to content

Releases: adeptex/whispers

2.4.0

05 Oct 15:34
@adeptex adeptex
2.4.0
24ee0f0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
2.4.0 Latest
Latest

Whispers 2.4.0 release notes

  • 💫 Remove Semgrep telemetry 💫
  • Lazy-load parsers
  • Severity levels reassignment
  • Detection rule improvements
    • URI credentials
    • AWS Account ID
  • Generalize default config

💫 Remove Semgrep telemetry 💫

It's a better world now that corporations build telemetry into every single piece of software... not really 😒... It was shoking to see telemetry packages installed as part of Whispers. But how did this happen?

As it turns out, Semgrep includes A LOT of code to support exfiltrating metadata and usage information from your machine. This Whispers release is largely dedicated to stripping out all unnecessary spyware garbage "required" by Semgrep. Apart from privacy, a nice side effect of this is that now Semgrep runs a lot faster when parsing ASTs! Win-win.

The following are 24 (out of 32.. wtf??) "required" Semgrep dependencies that are now excluded:

certifi==2024.8.30
charset-normalizer==3.3.2
Deprecated==1.2.14
googleapis-common-protos==1.65.0
idna==3.10
importlib_metadata==7.1.0
markdown-it-py==3.0.0
mdurl==0.1.2
opentelemetry-api==1.25.0
opentelemetry-exporter-otlp-proto-common==1.25.0
opentelemetry-exporter-otlp-proto-http==1.25.0
opentelemetry-instrumentation==0.46b0
opentelemetry-instrumentation-requests==0.46b0
opentelemetry-proto==1.25.0
opentelemetry-sdk==1.25.0
opentelemetry-semantic-conventions==0.46b0
opentelemetry-util-http==0.46b0
protobuf==4.25.5
Pygments==2.18.0
requests==2.32.3
rich==13.9.1
setuptools==75.1.0
urllib3==2.2.3
zipp==3.20.2

The confirmation of this great success can be seen in every pip3 install whispers log in the form of these amazing error messages:

ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
semgrep 1.85.0 requires attrs>=21.3, which is not installed.
semgrep 1.85.0 requires boltons~=21.0, which is not installed.
semgrep 1.85.0 requires click-option-group~=0.5, which is not installed.
semgrep 1.85.0 requires colorama~=0.4.0, which is not installed.
semgrep 1.85.0 requires defusedxml~=0.7.1, which is not installed.
semgrep 1.85.0 requires exceptiongroup~=1.2.0, which is not installed.
semgrep 1.85.0 requires glom~=22.1, which is not installed.
semgrep 1.85.0 requires opentelemetry-api~=1.25.0, which is not installed.
semgrep 1.85.0 requires opentelemetry-exporter-otlp-proto-http~=1.25.0, which is not installed.
semgrep 1.85.0 requires opentelemetry-instrumentation-requests~=0.46b0, which is not installed.
semgrep 1.85.0 requires opentelemetry-sdk~=1.25.0, which is not installed.
semgrep 1.85.0 requires peewee~=3.14, which is not installed.
semgrep 1.85.0 requires ruamel.yaml<0.18,>=0.16.0, which is not installed.
semgrep 1.85.0 requires tomli~=2.0.1, which is not installed.
semgrep 1.85.0 requires wcmatch~=8.3, which is not installed.

❌ Breaking changes ❌

❌ Severity levels reassignment ❌

Adjusted rule severity levels to add structure. New severity levels are the following:

Group Rule ID Severity Before Severity Now
keys aws-secret Critical Critical
keys aws-token Critical Critical
keys privatekey High Critical
keys apikey-known High Critical
keys apikey Medium High
keys aws-id Critical Medium
keys aws-account Low Low
keys apikey-maybe Low Low
passwords password High High
passwords uri High High
infra dockercfg High High
infra npmrc High High
infra pip High High
infra pypirc High High
infra htpasswd Medium Medium
misc webhook Low Medium
misc creditcard Low Low
misc secret Low Low
misc comment Info Info
files file-known Low Low

Changelog

Date Version Release notes
2021-12-07 2.0.0 https://github.com/adeptex/whispers/releases/tag/2.0.0
2022-07-29 2.1.0 https://github.com/adeptex/whispers/releases/tag/2.1.0
2023-10-23 2.2.0 https://github.com/adeptex/whispers/releases/tag/2.2.0
2024-06-16 2.3.0 https://github.com/adeptex/whispers/releases/tag/2.3.0
2024-10-05 2.4.0 https://github.com/adeptex/whispers/releases/tag/2.4.0
Assets 8
Loading

2.3.1

30 Sep 12:47
@adeptex adeptex
2.3.1
879dcab
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
2.3.1

Summary

  • Improved detection rules
  • Fixed detection bugs
  • Added Terraform detection support

What's Changed

Full Changelog: 2.3.0...2.3.1

Contributors

adeptex and dependabot
Assets 8
Loading

2.3.0

16 Jun 13:34
@adeptex adeptex
2.3.0
7f3f37e
Compare
Choose a tag to compare
2.3.0

Whispers 2.3.0 release notes

  • New Feature: 💫 Static Code Analysis 💫 is now supported!

    • The present release complements classic Whispers' structured text analysis with Semgrep's AST generator for common programming languages like Python, PHP, Java/Scala/Kotlin, JavaScript/TypeScript, Go, etc etc.
    • New argument --ast for enabling this feature via the CLI (it is disabled by default)
    • New setting ast: true for enabling this feature via a custom config file (set to ast: false by default)
    • Replaced astroid Python AST generator with semgrep

  • Detection rule improvements

    • Known API keys
    • AWS account ID
    • Passwords
    • Creditcards

  • Drop end-of-life Python support

    • Versions 3.6 and 3.7 are no longer supported. Oldest supported version is Python 3.8.
    • Last release that supports Python 3.6 and 3.7 is Whispers 2.2.1

  • Dependency tracking improvements

    • New requirements-dev.txt file allows Dependabot updates for dev dependencies
    • Modified setup.py to read from requirements.txt and requirements-dev.txt
    • Updated build CI to use Python 3.12.3

  • Debugging and troubleshooting

    • Modified config.yml to exclude known false positives
    • Fixed Dockerfile to work with docker build -t whispers . or the same make image
    • New arg --dump for generating an AST of a file: whispers --dump src/example.ts

💫 New Feature: Static Code Analysis 💫

With the release of Whispers 2.3, it is now possible to accurately apply Whispers' secret detection techniques for structured text to static code. Before this release, Whispers only supported structured text formats, such as JSON or XML. Semgrep is an open source SAST tool, which has a built-in feature for generating Abstract Structure Trees (ASTs) for many common programming languages. Generating an AST for static code yields an accurate structured text representation, which can be checked for secrets with Whispers' rules and plugins. As such, generating ASTs requires an additional "format conversion" step, which naturally affects runtime speed. When AST is enabled it will take longer to scan the same scope if any source code files are present. The increased amount of runtime time would be however long it takes to run the following command on all static code files in scope:

semgrep scan --metrics=off --quiet --dump-ast --json --lang $LANG $SRCFILE

Consider the following benchmarks:

time whispers -F " " tests/fixtures
# 313 detected secrets
# 0,51s user 0,03s system 99% cpu 0,540 total
# 0,60s user 0,04s system 99% cpu 0,642 total

time whispers -a -F " " tests/fixtures
# 421 detected secrets
# 2,20s user 0,40s system 100% cpu 2,589 total
# 2,32s user 0,46s system 100% cpu 2,772 total

AST conversion is disabled by default - semgrep will not execute at all unless explicitly enabled. Custom config files that are missing ast: false or ast: true will default to false.

ast: true  # enable AST in config.yml
whispers --ast target/dir/or/file  # enable AST in CLI

❌ Breaking changes ❌

❌ Replaced astroid with semgrep ❌

Before Whispers 2.3, only Python AST scanning was natively supported by astroid, and integrated via plugins/python.py. With the release of Whispers 2.3, this functionality is superseded by semgrep, and integrated via plugins/semgrep.py. As a base line, the new semgrep plugin detects the same findings as the astroid plugin, but supports more programming languages.

Unfortunately semgrep has telemetry enabled by default, but can be turned off via --metrics=off. In any case, semgrep will not execute unless explicitly enabled via args or config.

⚠️ NOTE: At the time of writing, semgrep does not support Windows OS natively, and can only be installed through WSL. As such, compiled Whispers PE32+ executable comes without Static Code Analysis support. Installing Whispers on Windows via WSL with pip3 install whispers does have Static Code Analysis support.

Changelog

Date Version Release notes
2021-12-07 2.0.0 https://github.com/adeptex/whispers/releases/tag/2.0.0
2022-07-29 2.1.0 https://github.com/adeptex/whispers/releases/tag/2.1.0
2023-10-23 2.2.0 https://github.com/adeptex/whispers/releases/tag/2.2.0
2024-06-16 2.3.0 https://github.com/adeptex/whispers/releases/tag/2.3.0

What's Changed

Full Changelog: 2.2.1...2.3.0

Contributors

adeptex and dependabot
Assets 8
Loading

2.2.1

02 Apr 19:59
@adeptex adeptex
2.2.1
1838c6a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
2.2.1

What's Changed

Full Changelog: 2.2.0...2.2.1

Contributors

adeptex and dependabot
Assets 8
Loading

2.2.0

24 Oct 20:31
@adeptex adeptex
2.2.0
185f7e2
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
2.2.0

Whispers 2.2.0 release notes

  • License change
  • Compatibility improvements
    • Standardize severity levels
    • Minor code refactor
  • Detection improvements
    • Add XML cases
    • Add apikey-maybe rule

💫 Licensing changes (again) 💫

Version 2.1 was released under GNU General Public License v3.0, which is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users.

Version 2.2 is released under BSD 3-Clause License, which is a permissive license that prohibits others from using the name of the copyright holder or its contributors to promote derived products without written consent.

This change removes source code disclosure requirement 🕵️

❌ Breaking changes ❌

❌ Severity levels ❌

Severity level names have been adapted to a more common format. For example, BLOCKER is replaced by Critical and so on. The full list is as follows:

Version 2.1 (before) Version 2.2 (now)
BLOCKER Critical
CRITICAL High
MAJOR Medium
MINOR Low
INFO Info

⚠️ Please update your custom rules and CLI args to reflect these changes ⚠️

Instead of

whispers -s BLOCKER dir/or/file

use

whispers -s Critical dir/or/file

See README for details and examples.

Changelog

Version Release notes
2.0.0 https://github.com/adeptex/whispers/releases/tag/2.0.0
2.1.0 https://github.com/adeptex/whispers/releases/tag/2.1.0
2.2.0 https://github.com/adeptex/whispers/releases/tag/2.2.0

What's Changed

Full Changelog: 2.1.5...2.2.0

Contributors

adeptex and dependabot
Assets 8
Loading

2.1.5

16 Sep 21:37
@adeptex adeptex
2.1.5
56c63b6
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
2.1.5

What's Changed

Full Changelog: 2.1.4...2.1.5

Contributors

adeptex
Assets 8
Loading

2.1.4

09 Sep 01:10
@adeptex adeptex
2.1.4
383c88a
This commit was signed with the committer’s verified signature.
adeptex Artëm Tsvetkov
GPG key ID: 2B212412AEC51AE4
Learn about vigilant mode.
Compare
Choose a tag to compare
2.1.4

What's Changed

  • Added nginx.conf parser and detection
  • Improved Shell variables detection
  • Updated Github Workflows to compile binaries as UTF-8
  • Bump astroid from 2.12.5 to 2.12.8 by @dependabot in #56
  • Bump astroid from 2.12.8 to 2.12.9 by @dependabot in #57

Full Changelog: 2.1.3...2.1.4

Contributors

dependabot
Assets 8
Loading

2.1.3

03 Sep 15:55
@adeptex adeptex
2.1.3
09b1aa6
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
2.1.3

What's Changed

  • Added detection for default values in Shell variables
  • Added detection for known Grafana keys
  • Added SHA256 checksums for compiled binaries
  • Bump astroid from 2.12.2 to 2.12.4 by @dependabot in #50
  • Bump astroid from 2.12.4 to 2.12.5 by @dependabot in #52

Full Changelog: 2.1.2...2.1.3

Contributors

dependabot
Assets 8
Loading

2.1.2

17 Aug 20:16
@adeptex adeptex
2.1.2
7c8448b
Compare
Choose a tag to compare
2.1.2

In order to compile the package with pyInstaller some minor adjustments were required. There are no functional changes in this release.

It is now possible to download and use Whispers as a binary for Linux, OSX and Windows. See releases page.

Full Changelog: 2.1.1...2.1.2

Assets 5
Loading

2.1.1

16 Aug 19:35
@adeptex adeptex
2.1.1
1b7023f
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
2.1.1

What's Changed

Full Changelog: 2.1.0...2.1.1

Contributors

adeptex
Assets 2
Loading