gitdb update breaks trufflehog

[danieldooley]

Probably related to #198

We install inside a docker container using:

$ pip install truffleHog==2.0.99

We run:

$ trufflehog --regex --entropy=False .

Starting today this errored with:

Traceback (most recent call last):
   File "/usr/local/bin/trufflehog", line 5, in <module>
     from truffleHog.truffleHog import main
   File "/usr/local/lib/python3.8/site-packages/truffleHog/truffleHog.py", line 17, in <module>
     from git import Repo
   File "/usr/local/lib/python3.8/site-packages/git/__init__.py", line 38, in <module>
     from git.config import GitConfigParser  # @NoMove @IgnorePep8
   File "/usr/local/lib/python3.8/site-packages/git/config.py", line 16, in <module>
     from git.compat import (
   File "/usr/local/lib/python3.8/site-packages/git/compat.py", line 16, in <module>
     from gitdb.utils.compat import (
 ModuleNotFoundError: No module named 'gitdb.utils.compat'

A quick dive down the dependency tree showed that the trufflehog dependency on gitpython-2.1.1 (here) is pulling in gitdb2-3.0.2 (here) which has removed the gitdb.utils.compat (PR)

Our fix for now is to use (may be useful to others):

pip install gitdb2==3.0.0 truffleHog==2.0.99

[samputer]

Thanks @danieldooley for the workaround.

[Harmon758]

See gitpython-developers/GitPython#983.

[HankQuiter]

pip install gitdb2==3.0.0 truffleHog==2.0.99

They just updated gitdb2.
I used
After I installed trufflehog (pip install trufflehog)
I did this:
pip install GitPython==3.0.6
and it worked

[dxa4481]

I'll bump gitpython in requirements.txt and see if that fixes it

[dxa4481]

So I pushed the temp fix to the dockerfile, and you can pull an image from here https://hub.docker.com/r/dxa4481/trufflehog

Sorry for the inconvenience, I'll work on a longer term fix when I get some time so folks can pip install again

[mzjp2]

Couldn't you pin gitdb2 in your setup.py/requirements.txt and release a new trufflehog version to get it pip installable asap?

[dxa4481]

Yup, my bad, getting really confused bc I was only updating requirements.txt and it wasn't fixing it. I had to update setup.py too, I'm a dummy.

Should be fixed? Please test and let me know.

[dionbosschieter]

I tested it and it works 👍 thanks

[dustin-decker]

Hey there, we've just released the next major version of TruffleHog!

It is a complete rewrite that scans more data sources and now supports detecting and verifying over 600 credentials.
Please check it out when you can.

https://trufflesecurity.com/blog/introducing-trufflehog-v3

We're no longer maintaining v2 so I am closing this issue.