.gitleaksignore

# gitleaks fingerprints that are not secrets (docs/architecture/ci-release.md, job gitleaks).
# One per line: <commit>:<file>:<rule>:<line>. Add a comment with the reason above each entry.

# SHA-256 of the Gateway API standard-install.yaml release asset, pinned in nightly.yml so the CRDs
# are only applied when they match. It was committed under a variable name that the generic-api-key
# rule took for an API key; the variable is GATEWAY_CRDS_SHA256 now.
4c4c1ddf345f41f36230bceaca7356dad36ac18d:.github/workflows/nightly.yml:generic-api-key:64

# Fake tunnel-token secrets in the host installer's tests: base64 of "secret-value-that-is-long-enough"
# and "secret-that-must-never-leak", made up so the tests can check that a secret never reaches a
# command line or the output.
7cf9bda435c1aaf9e70295fdbe4ebdee58c50929:deploy/host/tests/unit.test.ts:generic-api-key:118
7cf9bda435c1aaf9e70295fdbe4ebdee58c50929:deploy/host/tests/install.test.ts:generic-api-key:21

# The fingerprint of Cloudflare's public package signing key (CLOUDFLARE_KEY_FINGERPRINT), pinned so
# the installer trusts only that key; a public key fingerprint, which the cloudflare-api-key rule
# matches by its name and length.
7cf9bda435c1aaf9e70295fdbe4ebdee58c50929:deploy/host/src/desired.ts:cloudflare-api-key:53

# Test fixture in the chart's values test, not a secret: a lowercase hex run built from a repeated
# literal ("0123456789abcdef".repeat(4)), which the test expects to be reported as random-looking.
# The generic-api-key rule matched its old variable name hexKey; the variable is hexRun now. The
# commit exists only on the branch of PR Laysi/trustiot-v2#276.
6e00e42f42ec6d6373e5dce41f30f6d4af93cf67:deploy/chart/tests/chart.test.ts:generic-api-key:467

# Not a key: the code in the broker certificate CronJob that writes the PEM boundaries around the
# PKCS #8 key it generates at run time, which the private-key rule matched across the lines between
# them. The label is a constant now (PKCS8_KEY_LABEL), so the tree no longer matches. The commit
# exists only on the branch of the pull request for Laysi/trustiot-v2#535.
9dc4cae74e099b5d0c064f91e4d5b69cad0ac123:tools/migrate/src/mqtt_certificate.rs:private-key:333