DevSkim's findings are MD5 usage the .plg format requires, plus false positives — recommend keeping it disabled

[laywill]

DevSkim (REPOSITORY_DEVSKIM, .mega-linter.yml:51) reports 128 findings against tracked files: 116 errors, 4 warnings, 8 informational notes. 107 of the 120 error/warning findings are two rules that only ever fire on MD5 usage, and Unraid's own .plg format mandates MD5 — the <MD5> element is the only digest the plugin installer supports. I went through the rest and found nothing actionable either.

(The raw local log shows 130 findings; 2 of those — one DS137138, one DS117838 — are DevSkim matching its own machine's leftover scratch files under docs/sessions/upstream-issues/megalinter-reports-2026-08-10/, an untracked, gitignored directory that doesn't exist in a real clone of this repo. Excluded from every count below.)

Breakdown

Rule	Level	Count	What it actually flags
DS126858 Weak/Broken Hash Algorithm	error	105	MD5 — required by the .plg format
DS197836 Hash of low-entropy content	error	2	Same MD5 call sites
DS173237 Tokens/keys in source	error	6	Synthetic fixture IDs in one test file
DS440010 Hardcoded SSL/TLS version	error	3	False match on EXPECTED_PACKAGE_SHA256
DS137138 Insecure URL	warning	4	Private-bridge mirror, rejected-HTTP test fixtures
DS162092 Debug code in production	note	7	The word "debug" in log/docker logs strings
DS176209 Suspicious comment	note	1	A TODO-style comment in community-applications/ca_profile.xml

devskim 1.0.70 SARIF, decoded (megalinter-reports/linters_logs/REPOSITORY_DEVSKIM-ERROR.log)

DS126858 × 105 — build-plg.sh(29) tests/dev-package.sh(15) install-dev.sh(14)
                 .github/workflows/package-plugins.yml(13) .github/workflows/release.yml(12)
                 tests/install-dev-safety.sh(12) tests/package-contents.sh(10)
DS197836 × 2   — install-dev.sh:70, tests/dev-package.sh:92
DS173237 × 6   — tests/ownership-safety.sh:20,158,253,293,356,357
DS440010 × 3   — build-plg.sh:226,236, tests/dev-package.sh:154
DS137138 × 4   — tests/provider-mocks.sh:278, runner-farm.sh:1427,1514, tests/gitlab-policy.sh:34
DS162092 × 7   — runner-farm.sh:1384,1392, gitlab.sh:286,754,830, provider-mocks.sh:415, provider-contract.sh:268
DS176209 × 1   — community-applications/ca_profile.xml:5

The MD5 findings are not a choice

build-plg.sh:208 writes the plugin's own integrity field:

<MD5>&packageMD5;</MD5>

and build-plg.sh:346 computes it:

md5_of() { if command -v md5sum >/dev/null 2>&1; then md5sum "$1" | cut -d' ' -f1; else md5 -q "$1"; fi; }

install-dev.sh:143 checks the same entity back on install (("packageMD5", manifest["package_md5"])). Unraid's plugin installer verifies a <FILE> payload against its <MD5> element and supports no other digest, so every one of these 105 call sites exists because the platform requires it, not because the project chose MD5 over something stronger. It's also used correctly here — an integrity check against corruption inside a flow already authenticated by HTTPS and GitHub Releases, not a defense against a deliberate collision.

The rest

DS440010 "hardcode SSL/TLS versions" (3) — the snippet DevSkim actually flags is EXPECTED_PACKAGE_SHA256 at build-plg.sh:226, :236, and tests/dev-package.sh:154. There is no SSL/TLS configuration anywhere near these lines; it's a SHA256 checksum comparison for the dev-install flow, not a hardcoded protocol version.

DS173237 "tokens in source" (6) — all six are in tests/ownership-safety.sh, and all six are the same synthetic fixture: repeated-digit strings ("1111111111...111", "2222222222...222", ...) standing in for container IDs, not real credentials.

DS137138 "Insecure URL" (4) — one is the same private-bridge registry mirror as before (runner-farm.sh:1427, reached only by container name over an isolated bridge — TLS would add nothing there), one (runner-farm.sh:1514) is a case "$spec" in http://*) string-prefix match used only to pick a firewall port number, and two are test fixtures that assert an http:// GitLab/registry URL is rejected (tests/provider-mocks.sh:278, tests/gitlab-policy.sh:34) — DevSkim is flagging the negative-test input, not a real connection.

DS162092/DS176209 (8, informational only) — DoNotLeaveDebugCodeInProduction matches the word "debug" in log strings and docker logs invocations; SuspiciousComment is a TODO-style comment in an XML file. Both are note-level in this DevSkim version rather than warning, unlike the last time this was scanned — the rule severities appear to have shifted between DevSkim releases, not the code.

Per-rule suppression is possible, but doesn't get you to zero either

DevSkim's analyze command takes --ignore-rule-ids DS1234,DS5678, which MegaLinter exposes as REPOSITORY_DEVSKIM_ARGUMENTS. Suppressing just the two MD5 rules would remove 107 of the 120 countable findings:

REPOSITORY_DEVSKIM_ARGUMENTS: "--ignore-rule-ids DS126858,DS197836"

That still leaves DS173237, DS440010, and DS137138 firing — 13 more findings, and per the breakdown above, none of those are real either. Getting DevSkim to a clean, meaningful signal in this repo means suppressing effectively everything it currently flags here, which is functionally the same outcome as disabling it, just spread across a suppression list that needs revisiting every time DevSkim adds a rule.

Suggested change

Leave it disabled with the reasoning recorded:

DISABLE_LINTERS:
  # 107 of 120 countable findings are MD5 usage the Unraid .plg format
  # mandates (<MD5> is the only digest the plugin installer supports).
  # The rest are false positives: a checksum constant misread as a
  # hardcoded TLS version, synthetic test fixtures, and a private-bridge
  # registry mirror.
  - REPOSITORY_DEVSKIM

Security coverage doesn't shrink for it: trufflehog, secretlint, dustilock, grype, kics, syft, kingfisher, and trivy-sbom are already enabled and clean; REPOSITORY_BETTERLEAKS (renamed from gitleaks) is disabled pending its own fixture-allowlist issue.

If narrower coverage is preferred over disabling it outright, I can open a PR for the --ignore-rule-ids config instead.