Add audit baseline functionality

[domanchi]

Testing

detect-secrets$ pip install -e .
detect-secrets$ detect-secrets --scan test_data > .secrets.baseline
detect-secrets$ detect-secrets --audit .secrets.baseline

Output

Secrets Left: 1/14
Filename:     test_data/baseline.file
----------
4:  "results": {
5:    "file_with_secrets.py": [
6:      {
7:        "type": "High Entropy String",
8:        "line_number": 3,
9:        "hashed_secret": "262547656a76a8a5d24ad428e7010e0fbb8d0413"
10:      }
11:    ],
12:    "sample.diff": [
13:      {
14:        "type": "High Entropy String",
----------
Is this a valid secret? (y)es, (n)o, (s)kip, (q)uit:

Features

• Full colored, interactive auditor for secrets found through --scan.
• Ability to flag both false and true positives within the baseline.
• Handles case well where baseline's reported line number falls out of sync with actual code.
• skip allows you to revisit the secret at a later time.
• Audit sessions can be "saved" by quitting pre-maturely: secrets already audited will not need to be reviewed again.

Backwards Compatibility Considerations

This is a breaking change!

• Baselines will need to be created in sorted order as well as requiring the plugins_used list with proper initialization args.
• Private Key Detector now creates a hash of the blacklisted line, rather than the whole line itself. This will require all older baselines with this plugin to be rescanned, to get the new hash.
• SensitivityValues has been dropped. detect-secrets-server will need to be pinned on an older version, until fixed.

[KevinHock]

LGTM :D

[KevinHock]

I'm not sure I follow, why only do the first filename here?

[domanchi]

Ah, nice catch.

I throw in breaks when testing; looks like I missed a spot.

[KevinHock]

Nit: Maybe add some comments and space it out so there isn't the ))). I initially misread it as map gets all the secrets that don't have an is_secret attribute (i.e. the ones that have not been audited) and adds that number to the number of results in the baseline.

num_secrets_to_parse = sum(
  map(
      lambda filename: len(
        list(
          filter(
              lambda secret: not hasattr(secret, 'is_secret'),
              baseline['results'][filename],
          )
        )
      ),
      baseline['results'],
  )
)

[KevinHock]

Very nice. :D

[KevinHock]

I think it'd be more pythonic/you wouldn't need a comment (uncle bob 💯 ), if you did for .. else (i.e. if you don't take a break you get a raise.)

[KevinHock]

Wow, woah, this is reel nice 🍰 ⚡️ 💡