diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..492b277 --- /dev/null +++ b/.gitignore @@ -0,0 +1,7 @@ +trivy +syft +grype +gitleaks +deps +snyk +index.html \ No newline at end of file diff --git a/README.md b/README.md index 47a840e..dad3a33 100644 --- a/README.md +++ b/README.md @@ -1,20 +1,10 @@ -# New Repository Template +# Security Scanner -This template contains all of our basic files for a new GitHub repository. There is also a handy workflow that will create an issue on a new repository made from this template, with a checklist for the steps we usually take in setting up a new repository. - -If you're starting a Node.JS project with TypeScript, we have a [specific template](https://github.com/naomi-lgbt/nodejs-typescript-template) for that purpose. - -## Readme - -Delete all of the above text (including this line), and uncomment the below text to use our standard readme template. - - +We may be contacted through our [Chat Server](http://chat.nhcarrigan.com) or via email at `contact@nhcarrigan.com`. diff --git a/scan.sh b/scan.sh new file mode 100755 index 0000000..ee6ef18 --- /dev/null +++ b/scan.sh @@ -0,0 +1,87 @@ +# Clean existing reports. +rm -r ./gitleaks; +rm -r ./trivy; +rm -r ./grype; +rm -r ./syft; +rm -r ./snyk; +rm -r ./deps; + +# Create the directories for the reports. +mkdir ./gitleaks; +mkdir ./trivy; +mkdir ./grype; +mkdir ./syft; +mkdir ./snyk; +mkdir ./deps; + +# Parse directories for all of the projects we "own". +repositories=($(find /home/naomi/code/naomi -maxdepth 1 -type d -not -name '.' -printf "%f\n" | sort)); +html=(); + +for directory in "${repositories[@]}"; do + if [ $directory == "naomi" ] || [ $directory == "security" ]; then + continue; + fi; + echo "Scanning $directory"; + + # Automated scanning tools + gitleaks detect --source /home/naomi/code/naomi/$directory -r ./gitleaks/$directory.json --no-banner; + trivy repo --format json --output ./trivy/$directory.json /home/naomi/code/naomi/$directory; + grype -o json --file ./grype/$directory.json /home/naomi/code/naomi/$directory; + syft scan /home/naomi/code/naomi/$directory -o json=./syft/$directory.json; + + # Need to move directories for Snyk to track the target correctly. + cd /home/naomi/code/naomi/$directory; + snyk monitor --dev --project-name=$directory --remote-repo-url=$(git remote get-url origin) /home/naomi/code/naomi/$directory; + snyk test --dev --json --json-file-output=/home/naomi/code/naomi/security/snyk/$directory.json /home/naomi/code/naomi/$directory; + cd /home/naomi/code/naomi/security; + + # Manual dependency version checks (no reliable package to do this for us :/ ) + echo "No supported package manager found in this project." > /home/naomi/code/naomi/security/deps/$directory.txt; + if [ -f /home/naomi/code/naomi/$directory/package.json ]; then + cd /home/naomi/code/naomi/$directory; + pnpm outdated | grep -v "^WARN" > /home/naomi/code/naomi/security/deps/$directory.txt; + cd /home/naomi/code/naomi/security; + fi; + if [ -f /home/naomi/code/naomi/$directory/Pipfile ]; then + cd /home/naomi/code/naomi/$directory; + pip list --outdated > /home/naomi/code/naomi/security/deps/$directory.txt; + cd /home/naomi/code/naomi/security; + fi; + if [ -f /home/naomi/code/naomi/$directory/*.csproj ]; then + cd /home/naomi/code/naomi/$directory; + dotnet list package --outdated > /home/naomi/code/naomi/security/deps/$directory.txt; + cd /home/naomi/code/naomi/security; + fi; + if [ -f /home/naomi/code/naomi/$directory/go.mod ]; then + cd /home/naomi/code/naomi/$directory; + go list -m -u all > /home/naomi/code/naomi/security/deps/$directory.txt; + cd /home/naomi/code/naomi/security; + fi; + if [ -f /home/naomi/code/naomi/$directory/rockspec ]; then + cd /home/naomi/code/naomi/$directory; + luarocks list --outdated > /home/naomi/code/naomi/security/deps/$directory.txt; + cd /home/naomi/code/naomi/security; + fi; + if [ -f /home/naomi/code/naomi/$directory/composer.json ]; then + cd /home/naomi/code/naomi/$directory; + composer outdated --format=json > /home/naomi/code/naomi/security/deps/$directory.json; + cd /home/naomi/code/naomi/security; + fi; + if [ -f /home/naomi/code/naomi/$directory/Gemfile ]; then + cd /home/naomi/code/naomi/$directory; + bundle outdated > /home/naomi/code/naomi/security/deps/$directory.txt; + cd /home/naomi/code/naomi/security; + fi; + if [ -f /home/naomi/code/naomi/$directory/Cargo.toml ]; then + cd /home/naomi/code/naomi/$directory; + cargo outdated > /home/naomi/code/naomi/security/deps/$directory.txt; + cd /home/naomi/code/naomi/security; + fi; + html+=("

$directory

  • Outdated Dependencies"); +done; + +echo "Security Audits

    Security Audits

    A collection of the various reporting tools we run against our repositories.

    Contributions to resolve a reported issue are welcomed!

    ${html[*]}
    " > ./index.html; + +# Deploy the reports to the production server. +GLOBIGNORE='.git' scp -r ./* prod:/home/nhcarrigan/security \ No newline at end of file