gitrob 1.0.1 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0171119bcd3912ad9ee1967af3c23ac9d5b901e5
-  data.tar.gz: 5626794c851de7b3ab38489bebf25338faa8d215
+  metadata.gz: 5ad1363305b13ddc14f0f3925d2f0186a49afb14
+  data.tar.gz: ad49ab2e0e2383f7f37672f04ddd83aa27fdc2d0
 SHA512:
-  metadata.gz: 4bb217ad1504c7abc823684cb49cc001812e61b415e4a1a33a4c1bf74e922aa411fc568b6962e3f360f32102acfec33dcb688b79ae6e88a3f951b690915ae53a
-  data.tar.gz: 27d602e2e9df9bcfb7960faab9ac4ee1f0adac237d9d70302df5ba08a665d59c3ca82c52473b3a5ef682c6358eb948e14e0d99dcb0288cd7da23a09bb5dfeed2
+  metadata.gz: 1c36118753c8cb59074a0ce9ff823b53864fc2c7931941484783bf3f6e512dc4d24e869c9e6ef1726f21aae3819e2f6fd98dcd1ab7f9c0b38062f760ca1f036f
+  data.tar.gz: 5c9a28a3d1ae91a23b820827fb0a385a69c4ba77f35fb885591229938e69bc460c7c0787b3afc819611cdb079bc1d03c437f9e6c703c05c55ac06c1da0d2c4fc

data/CHANGELOG.md

@@ -4,6 +4,15 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased]
 
+## [1.1.0]
+### Added
+ - Ability to define custom signatures in `~/.gitrobsignatures`
+
+### New signatures
+ - Terraform variable configuration files (`filename == "terraform.tfvars"`)
+   Thanks to [Alfonso Cabrera](https://github.com/alfonso-cabrera)
+ - Environment configuration files (`filename =~ /\A\.?env\z/`)
+
 ## [1.0.1]
 ### Fixed
  - The `--verify-ssl` command option did not properly set SSL configuration

data/README.md

@@ -70,7 +70,7 @@ See `gitrob help analyze` for more options.
 
 Gitrob can analyze organizations and users on custom GitHub Enterprise installations instead of the official GitHub site. The `analyze` command takes several options to control this:
 
-    gitrob analyze johndoe --site=https://github.acme.com --endpoint=https://github.acme.com/api --access-tokens=token1,token2
+    gitrob analyze johndoe --site=https://github.acme.com --endpoint=https://github.acme.com/api/v3 --access-tokens=token1,token2
 
 See `gitrob help analyze` for more options.
 
@@ -86,7 +86,40 @@ By default, the server will listen on [localhost:9393](http://localhost:9393). T
 
 See `gitrob help server` for more options.
 
-### Starting the web server
+### Adding custom signatures
+
+If you want to look for files that are specific to your organisation or projects, it is easy to add custom signatures.
+
+When Gitrob starts it looks for a file at `~/.gitrobsignatures` which it expects to be a JSON document with signatures that follow the same structure as the main [signatures.json](signatures.json) file. Here is an example:
+
+    [
+      {
+        "part": "filename",
+        "type": "match",
+        "pattern": "otr.private_key",
+        "caption": "Pidgin OTR private key",
+        "description": null
+      }
+    ]
+
+ This signature instructs Gitrob to flag files where the filename exactly matches `otr.private_key`. The caption and description are used in the web interface when displaying the findings.
+
+#### Signature keys
+
+ * `part`: Can be one of:
+     * `path`: The complete file path
+     * `filename`: Only the filename
+     * `extension`: Only the file extension
+ * `type`: Can be one of:
+     * `match`: Simple match of part and pattern
+     * `regex`: Regular expression matching of part and pattern
+ * `pattern`: The value or regular expression to match with
+ * `caption`: A short description of the finding
+ * `description`: More detailed description if needed (set to `null` if not).
+
+Have a look at the main [signatures.json](signatures.json) file for more examples of signatures.
+
+**If you think other people can benefit from your custom signatures, please consider contributing them back to the Gitrob project by opening a Pull Request or an Issue. Thanks!**
 
 ## Development
 

data/lib/gitrob/blob_observer.rb

@@ -2,6 +2,8 @@ module Gitrob
   class BlobObserver
     SIGNATURES_FILE_PATH = File.expand_path(
       "../../../signatures.json", __FILE__)
+    CUSTOM_SIGNATURES_FILE_PATH = File.join(
+      Dir.home, ".gitrobsignatures")
 
     REQUIRED_SIGNATURE_KEYS = %w(part type pattern caption description)
     ALLOWED_TYPES           = %w(regex match)
@@ -30,23 +32,49 @@ module Gitrob
 
     def self.load_signatures!
       @signatures = []
-      JSON.load(File.read(SIGNATURES_FILE_PATH)).each do |signature|
+      signatures = JSON.load(File.read(SIGNATURES_FILE_PATH))
+      validate_signatures!(signatures)
+      signatures.each_with_index do |signature|
         @signatures << Signature.new(signature)
       end
-      validate_signatures!
     rescue CorruptSignaturesError => e
       raise e
     rescue
       raise CorruptSignaturesError, "Could not parse signature file"
     end
 
-    def self.validate_signatures!
+    def self.unload_signatures
+      @signatures = []
+    end
+
+    def self.custom_signatures?
+      File.exist?(CUSTOM_SIGNATURES_FILE_PATH)
+    end
+
+    def self.load_custom_signatures!
+      signatures = JSON.load(File.read(CUSTOM_SIGNATURES_FILE_PATH))
+      validate_signatures!(signatures)
+      signatures.each do |signature|
+        @signatures << Signature.new(signature)
+      end
+    rescue CorruptSignaturesError => e
+      raise e
+    rescue
+      raise CorruptSignaturesError, "Could not parse signature file"
+    end
+
+    def self.validate_signatures!(signatures)
       if !signatures.is_a?(Array) || signatures.empty?
         fail CorruptSignaturesError,
              "Signature file contains no signatures"
       end
-      signatures.each do |signature|
-        validate_signature!(signature)
+      signatures.each_with_index do |signature, index|
+        begin
+          validate_signature!(signature)
+        rescue CorruptSignaturesError => e
+          raise CorruptSignaturesError,
+                "Validation failed for Signature ##{index + 1}: #{e.message}"
+        end
       end
     end
 
@@ -58,7 +86,7 @@ module Gitrob
 
     def self.validate_signature_keys!(signature)
       REQUIRED_SIGNATURE_KEYS.each do |key|
-        unless signature.respond_to?(key)
+        unless signature.key?(key)
           fail CorruptSignaturesError,
                "Missing required signature key: #{key}"
         end
@@ -66,16 +94,16 @@ module Gitrob
     end
 
     def self.validate_signature_type!(signature)
-      unless ALLOWED_TYPES.include?(signature.type)
+      unless ALLOWED_TYPES.include?(signature["type"])
         fail CorruptSignaturesError,
-             "Invalid signature type: #{signature.type}"
+             "Invalid signature type: #{signature['type']}"
       end
     end
 
     def self.validate_signature_part!(signature)
-      unless ALLOWED_PARTS.include?(signature.part)
+      unless ALLOWED_PARTS.include?(signature["part"])
         fail CorruptSignaturesError,
-             "Invalid signature part: #{signature.part}"
+             "Invalid signature part: #{signature['part']}"
       end
     end
 

data/lib/gitrob/cli/commands/analyze.rb

@@ -40,6 +40,15 @@ module Gitrob
           task("Loading signatures...", true) do
             Gitrob::BlobObserver.load_signatures!
           end
+
+          if Gitrob::BlobObserver.custom_signatures?
+            task("Loading custom signatures...", true) do
+              Gitrob::BlobObserver.load_custom_signatures!
+            end
+            info("Please consider contributing your custom signatures to the " \
+                 "Gitrob project.")
+          end
+          info("Loaded #{Gitrob::BlobObserver.signatures.count} signatures")
         end
 
         def start_web_server

data/lib/gitrob/version.rb

@@ -1,3 +1,3 @@
 module Gitrob
-  VERSION = "1.0.1"
+  VERSION = "1.1.0"
 end

data/signatures.json

@@ -537,5 +537,19 @@
     "pattern": "\\A\\.?npmrc\\z",
     "caption": "NPM configuration file",
     "description": "Might contain credentials for NPM registries"
+  },
+  {
+    "part": "filename",
+    "type": "match",
+    "pattern": "terraform.tfvars",
+    "caption": "Terraform variable config file",
+    "description": "Might contain credentials for terraform providers"
+  },
+  {
+    "part": "filename",
+    "type": "regex",
+    "pattern": "\\A\\.?env\\z",
+    "caption": "Environment configuration file",
+    "description": null
   }
 ]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitrob
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.1.0
 platform: ruby
 authors:
 - Michael Henriksen
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-03-24 00:00:00.000000000 Z
+date: 2016-04-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor