genuinetools / audit Goto Github PK

For auditing what collaborators, hooks, and deploy keys you have added on all your GitHub repositories.

License: MIT License

Makefile 25.54% Go 72.04% Dockerfile 2.42%

github git auditing security repos repo cli

audit's Introduction

audit

For checking what collaborators, hooks, deploy keys, and protected branches you have added on all your GitHub repositories. This also scans all an organization's repos you have permission to view. Because nobody has enough RAM in their brain to remember this stuff for 100+ repos.

ARCHIVED IN FAVOR OF PEPPER: Check out genuinetools/pepper. Pepper does everything audit did.

Table of Contents

Installation
- Binaries
- Via Go
Usage

Installation

Binaries

For installation instructions from binaries please visit the Releases Page.

Via Go

$ go get github.com/genuinetools/audit

Usage

$ audit -h
audit -  Tool to audit what collaborators, hooks, and deploy keys are on your GitHub repositories.

Usage: audit <command>

Flags:

  -d      enable debug logging (default: false)
  -owner  only audit repos the token owner owns (default: false)
  -orgs   specific orgs to check (e.g. 'genuinetools')
  -repo   specific repo to test (e.g. 'genuinetools/audit') (default: <none>)
  -token  GitHub API token (or env var GITHUB_TOKEN)

Commands:

  version  Show the version information.

$ audit --token 12345
genuinetools/apk-file ->
        Hooks (1):
                travis - active:true (https://api.github.com/repos/genuinetools/apk-file/hooks/8426605)
        Protected Branches (1): master
--

genuinetools/apparmor-docs ->
        Keys (1):
                jenkins - ro:false (https://api.github.com/repos/genuinetools/apparmor-docs/keys/18549738)
        Unprotected Branches (1): master
--

genuinetools/bane ->
        Hooks (1):
                travis - active:true (https://api.github.com/repos/genuinetools/bane/hooks/6178025)
        Protected Branches (1): master
--

genuinetools/battery ->
        Hooks (1):
                travis - active:true (https://api.github.com/repos/genuinetools/battery/hooks/8388640)
        Protected Branches (1): master
        Unprotected Branches (1): WIP
--

genuinetools/irssi ->
	Collaborators (3): tianon, genuinetools, docker-library-bot
	Hooks (1):
		docker - active:true (https://api.github.com/repos/genuinetools/irssi/hooks/3918042)
	Protected Branches (1): master
--

audit's People

Contributors

Stargazers

Watchers

audit's Issues

New permission statuses results in missing admins

GitHub has added "maintain" and "triage"

Is -orgs mandatory?

It is unclear whether the -orgs flag is mandatory. Without it, with a Personal Access Token, audit does not return any results for me. With -orgs it behaves as expected (output similar to README)

Should a query occur for the orgs accessible (/user/orgs) in the case of empty orgs? Or should the docs mention it (or, should it be a mandatory flag)? Thanks!

change to use graphql api

to prevent using so many api requests this should be changed to use the GitHub GraphQL api.

guide here: https://developer.github.com/v4/guides/forming-calls/
explorer here: https://developer.github.com/v4/explorer/

reply dibs here to make this yours :)

Possibly doesn't work with large responses?

If I try to run audit for the owncloud GitHub org it results in an seg fault because of an invalid memory address or nil pointer dereference issue. That's what I get from audit:

# audit -d --orgs owncloud
DEBU[0000] Getting current user...
DEBU[0000] current user is tboerger
DEBU[0000] Setting affiliations to OWNER,COLLABORATOR,ORGANIZATION_MEMBER
DEBU[0000] Getting repositories for org owncloud...
DEBU[0000] Executing GraphQL query to fetch repos under org owncloud
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x10 pc=0x126ac1d]

goroutine 1 [running]:
main.(*GQLClient).Execute(0xc0000dfdb0, 0xc000458800, 0x71c, 0xc0004bcbd0, 0x1295a00, 0xc00041a7d0, 0x12922c0, 0xc000473920, 0x0, 0x0)
	/Users/thomas/Golang/src/github.com/genuinetools/audit/graphql.go:83 +0x43d
main.getRepositories(0x137a280, 0xc0000b6040, 0xc000128000, 0xc0000dfdb0, 0xc0004bcba0, 0x3, 0x3, 0x0, 0x0, 0x7ffeefbfe988, ...)
	/Users/thomas/Golang/src/github.com/genuinetools/audit/main.go:179 +0x32e
main.main.func2(0x137a280, 0xc0000b6040, 0xc0000120f0, 0x0, 0x0, 0x0, 0x0)
	/Users/thomas/Golang/src/github.com/genuinetools/audit/main.go:135 +0x826
github.com/genuinetools/audit/vendor/github.com/genuinetools/pkg/cli.(*Program).run(0xc000112000, 0x137a340, 0xc0000beb70, 0xc0000120c0, 0x4, 0x4, 0x10ad9fd, 0x13134b4)
	/Users/thomas/Golang/src/github.com/genuinetools/audit/vendor/github.com/genuinetools/pkg/cli/cli.go:179 +0x253
github.com/genuinetools/audit/vendor/github.com/genuinetools/pkg/cli.(*Program).Run(0xc000112000)
	/Users/thomas/Golang/src/github.com/genuinetools/audit/vendor/github.com/genuinetools/pkg/cli/cli.go:89 +0x61
main.main()
	/Users/thomas/Golang/src/github.com/genuinetools/audit/main.go:153 +0x3f2

After that I tried to find more information, I moved the errors parsing above the data parsing, and found this error message via Printf:

Something went wrong while executing your query. This may be the result of a timeout, or it could be a GitHub bug. Please include `E7C0:116E:271B82:432CFE:5D78ACF1` when reporting this issue.

So far for my debugging, but I have no idea how this issue could be resolved. Maybe somebody of you got an idea?

genuinetools / audit Goto Github PK

audit's Introduction

audit

Installation

Binaries

Via Go

Usage

audit's People

Contributors

Stargazers

Watchers

Forkers

audit's Issues

New permission statuses results in missing admins

Is -orgs mandatory?

change to use graphql api

Possibly doesn't work with large responses?

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent