legitify: Detect and remediate misconfigurations, security and compliance issues across all your GitHub assets

legitify

Detect and remediate misconfigurations, security, and compliance issues across all your GitHub assets with ease.

 

Scorecard Support

scorecard is an OSSF’s open-source project:

Scorecards is an automated tool that assesses a number of important heuristics (“checks”) associated with software security and assigns each check a score of 0-10. You can use these scores to understand specific areas to improve in order to strengthen the security posture of your project. You can also assess the risks that dependencies introduce, and make informed decisions about accepting these risks, evaluating alternative solutions, or working with the maintainers to make improvements.

legitify supports running scorecard for all of the organization’s repositories, enforcing score policies, and showing the results using the –scorecard flag:

• no – do not run the scorecard (default).
• yes – run scorecard and employ a policy that alerts each repo score below 7.0.
• verbose – run scorecard, employ a policy that alerts on each repo score below 7.0, and embed its output to legitify’s output.

legitify runs the following scorecard checks:

Check	Public Repository	Private Repository
Security-Policy	V
CII-Best-Practices	V
Fuzzing	V
License	V
Signed-Releases	V
Branch-Protection	V	V
Code-Review	V	V
Contributors	V	V
Dangerous-Workflow	V	V
Dependency-Update-Tool	V	V
Maintained	V	V
Pinned-Dependencies	V	V
SAST	V	V
Token-Permissions	V	V
Vulnerabilities	V	V
Webhooks	V	V

Policies

legitify comes with a set of policies in the policies/github directory. These policies are documented here.

In addition, you can use the –policies-path (-p) flag to specify a custom directory for OPA policies.

Usage

By default, legitify will check the policies against all your resources (organizations, repositories, members, actions).

You can control which resources will be analyzed with command-line flags namespace and org:

• –namespace (-n): will analyze policies that relate to the specified resources
• –org: will limit the analysis to the specified organizations

The above command will test organization and member policies against org1 and org2.

Namespaces

Namespaces in legitify are resources that are collected and run against the policies. Currently, the following namespaces are supported:

1. organization– organization-level policies (e.g., “Two-Factor Authentication Is Not Enforced for the Organization”)
2. actions – organization GitHub Actions policies (e.g., “GitHub Actions Runs Are Not Limited To Verified Actions”)
3. member – organization members policies (e.g., “Stale Admin Found”)
4. repository – repository level policies (e.g., “Code Review By At Least Two Reviewers Is Not Enforced”)

By default, legitify will analyze all namespaces. You can limit only to selected ones with the –namespace flag, and then a comma-separate list of the selected namespaces.

Output Options

By default, legitify will output the results in a human-readable format. This includes the list of policy violations listed by severity, as well as a summary table that is sorted by namespace.

Output Formats

Using the –output-format (-f) flag, legitify supports outputting the results in the following formats:

1. human-readable – Human-readable text (default).
2. json – Standard JSON.

Output Schemes

Using the –output-scheme flag, legitify supports outputting the results in different grouping schemes. Note: –output-format=json must be specified to output non-default schemes.

1. flattened – No grouping; A flat listing of the policies, each with its violations (default).
2. group-by-namespace – Group the policies by their namespace.
3. group-by-resource – Group the policies by their resource e.g. specific organization/repository.
4. group-by-severity – Group the policies by their severity.

Output Destinations

• –output-file – full path of the output file (default: no output file, prints to stdout).
• –error-file – full path of the error logs (default: ./errors.log).

Coloring

When outputting in a human-readable format, legitify supports the conventional –color[=when] flag, which has the following options:

• auto – colored output if stdout is a terminal, uncolored otherwise (default).
• always – colored output regardless of the output destination.
• none – uncolored output regardless of the output destination.

Misc

• Use the –failed-only flag to filter-out passed/skipped checks from the result.

Install

Copyright (C) 2022 Legit Security