[draft] Switch to using tristate verification state

pkg/custom_detectors/custom_detectors.go

@@ -163,9 +163,10 @@ func (c *customRegexWebhook) createResults(ctx context.Context, match map[string
 		// TODO: Read response body.
 		res.Body.Close()
 		if res.StatusCode == http.StatusOK {
-			result.Verified = true
+			result.Verified = detectors.Verified
 			break
 		}
+		result.Verified = detectors.Unverified
 	}
 
 	select {

pkg/detectors/aws/aws.go

@@ -172,37 +172,38 @@ func (s scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				req.URL.RawQuery = params.Encode()
 
 				res, err := client.Do(req)
-				if err == nil {
-
-					if res.StatusCode >= 200 && res.StatusCode < 300 {
-						identityInfo := identityRes{}
-						err := json.NewDecoder(res.Body).Decode(&identityInfo)
-						if err == nil {
-							s1.Verified = true
-							s1.ExtraData = map[string]string{
-								"account": identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.Account,
-								"user_id": identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.UserID,
-								"arn":     identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.Arn,
-							}
-						}
-						res.Body.Close()
-					} else {
-						// This function will check false positives for common test words, but also it will make sure the key appears "random" enough to be a real key.
-						if detectors.IsKnownFalsePositive(resSecretMatch, detectors.DefaultFalsePositives, true) {
-							continue
+				if err != nil {
+					continue
+				}
+				s1.Verified = detectors.Unverified
+				if res.StatusCode >= 200 && res.StatusCode < 300 {
+					identityInfo := identityRes{}
+					err := json.NewDecoder(res.Body).Decode(&identityInfo)
+					if err == nil {
+						s1.Verified = detectors.Verified
+						s1.ExtraData = map[string]string{
+							"account": identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.Account,
+							"user_id": identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.UserID,
+							"arn":     identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.Arn,
 						}
 					}
+					res.Body.Close()
+				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears "random" enough to be a real key.
+					if detectors.IsKnownFalsePositive(resSecretMatch, detectors.DefaultFalsePositives, true) {
+						continue
+					}
 				}
 			}
 
 			// If the result is unverified and matches something like a git hash, don't include it in the results.
-			if !s1.Verified && falsePositiveSecretCheck.MatchString(resSecretMatch) {
+			if s1.Verified == detectors.Unverified && falsePositiveSecretCheck.MatchString(resSecretMatch) {
 				continue
 			}
 
 			results = append(results, s1)
 			// If we've found a verified match with this ID, we don't need to look for any more. So move on to the next ID.
-			if s1.Verified {
+			if s1.Verified == detectors.Verified {
 				break
 			}
 		}
@@ -219,7 +220,7 @@ func awsCustomCleanResults(results []detectors.Result) []detectors.Result {
 	idResults := map[string]detectors.Result{}
 	for _, result := range results {
 		// Always accept the verified result as the result for the given ID.
-		if result.Verified {
+		if result.Verified == detectors.Verified {
 			idResults[result.Redacted] = result
 			continue
 		}

pkg/detectors/detectors.go

@@ -14,6 +14,13 @@ import (
 	"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
 )
 
+const (
+	// Convenience consts for implementing detectors.
+	Unknown    = detectorspb.VerifiedResult_VERIFIED_UNKNOWN
+	Verified   = detectorspb.VerifiedResult_VERIFIED
+	Unverified = detectorspb.VerifiedResult_UNVERIFIED
+)
+
 // Detector defines an interface for scanning for and verifying secrets.
 type Detector interface {
 	// FromData will scan bytes for results, and optionally verify them.
@@ -45,7 +52,7 @@ type Result struct {
 	DetectorName string
 	// DecoderType is the type of Decoder.
 	DecoderType detectorspb.DecoderType
-	Verified    bool
+	Verified    detectorspb.VerifiedResult
 	// Raw contains the raw secret identifier data. Prefer IDs over secrets since it is used for deduping after hashing.
 	Raw []byte
 	// RawV2 contains the raw secret identifier that is a combination of both the ID and the secret.
@@ -94,7 +101,7 @@ func CleanResults(results []Result) []Result {
 	var cleaned = make(map[string]Result, 0)
 
 	for _, s := range results {
-		if s.Verified {
+		if s.Verified == Verified {
 			cleaned[s.Redacted] = s
 		}
 	}

pkg/output/github_actions.go

@@ -15,7 +15,7 @@ func PrintGitHubActionsOutput(r *detectors.ResultWithMetadata) error {
 	out := gitHubActionsOutputFormat{
 		DetectorType: r.Result.DetectorType.String(),
 		DecoderType:  r.Result.DecoderType.String(),
-		Verified:     r.Result.Verified,
+		Verified:     r.Result.Verified.String(),
 	}
 
 	meta, err := structToMap(r.SourceMetadata.Data)
@@ -38,9 +38,11 @@ func PrintGitHubActionsOutput(r *detectors.ResultWithMetadata) error {
 		}
 	}
 
-	verifiedStatus := "unverified"
-	if out.Verified {
+	verifiedStatus := "unknown"
+	if out.Verified == detectors.Verified.String() {
 		verifiedStatus = "verified"
+	} else if out.Verified == detectors.Unverified.String() {
+		verifiedStatus = "unverified"
 	}
 
 	key := fmt.Sprintf("%s:%s:%s:%s:%d", out.DecoderType, out.DetectorType, verifiedStatus, out.Filename, out.StartLine)
@@ -66,7 +68,7 @@ func PrintGitHubActionsOutput(r *detectors.ResultWithMetadata) error {
 type gitHubActionsOutputFormat struct {
 	DetectorType,
 	DecoderType string
-	Verified  bool
+	Verified  string
 	StartLine int64
 	Filename  string
 }

pkg/output/json.go

@@ -26,7 +26,7 @@ func PrintJSON(r *detectors.ResultWithMetadata) error {
 		DetectorName string
 		// DecoderName is the string name of the DecoderType.
 		DecoderName string
-		Verified    bool
+		Verified    string
 		// Raw contains the raw secret data.
 		Raw string
 		// RawV2 contains the raw secret identifier that is a combination of both the ID and the secret.
@@ -45,7 +45,7 @@ func PrintJSON(r *detectors.ResultWithMetadata) error {
 		DetectorType:   r.DetectorType,
 		DetectorName:   r.DetectorType.String(),
 		DecoderName:    r.DecoderType.String(),
-		Verified:       r.Verified,
+		Verified:       r.Verified.String(),
 		Raw:            string(r.Raw),
 		RawV2:          string(r.RawV2),
 		Redacted:       r.Redacted,

pkg/output/plain.go

@@ -18,13 +18,14 @@ var (
 	yellowPrinter = color.New(color.FgYellow)
 	greenPrinter  = color.New(color.FgHiGreen)
 	whitePrinter  = color.New(color.FgWhite)
+	redPrinter    = color.New(color.FgRed)
 )
 
 func PrintPlainOutput(r *detectors.ResultWithMetadata) error {
 	out := outputFormat{
 		DetectorType: r.Result.DetectorType.String(),
 		DecoderType:  r.Result.DecoderType.String(),
-		Verified:     r.Result.Verified,
+		Verified:     r.Result.Verified.String(),
 		MetaData:     r.SourceMetadata,
 		Raw:          strings.TrimSpace(string(r.Result.Raw)),
 	}
@@ -36,11 +37,13 @@ func PrintPlainOutput(r *detectors.ResultWithMetadata) error {
 
 	printer := greenPrinter
 
-	if out.Verified {
+	if out.Verified == detectors.Verified.String() {
 		yellowPrinter.Print("Found verified result 🐷🔑\n")
-	} else {
+	} else if out.Verified == detectors.Unverified.String() {
 		printer = whitePrinter
 		whitePrinter.Print("Found unverified result 🐷🔑❓\n")
+	} else {
+		redPrinter.Print("Found unknown result 🐷🔑❓\n")
 	}
 	printer.Printf("Detector Type: %s\n", out.DetectorType)
 	printer.Printf("Decoder Type: %s\n", out.DecoderType)
@@ -98,7 +101,7 @@ func structToMap(obj interface{}) (m map[string]map[string]interface{}, err erro
 type outputFormat struct {
 	DetectorType,
 	DecoderType string
-	Verified bool
+	Verified string
 	Raw      string
 	*source_metadatapb.MetaData
 }

proto/detectors.proto

@@ -929,10 +929,16 @@ enum DetectorType {
   Prefect = 918;
 }
 
+enum VerifiedResult {
+  VERIFIED_UNKNOWN = 0;
+  UNVERIFIED = 1;
+  VERIFIED = 2;
+}
+
 message Result {
   int64 source_id = 2;
   string redacted = 3;
-  bool verified = 4;
+  VerifiedResult verified = 4;
   string hash = 5;
   map<string, string> extra_data = 6;
   StructuredData structured_data = 7;