BOTTLENECK
0 articles opened

Part I · Day One · Ten minutes · p. 11

Five commands. No account.

No configuration. Nothing to uninstall afterward except one binary.

  1. 1

    Install

    Prefer the release binary: download, verify SHA256SUMS + Sigstore keyless (cosign), put it on PATH. The install script is fastest and reasonable for a laptop, not for a fleet. We are aware of the irony of piping a script in an issue about not trusting code from the internet.

  2. 2

    Acquire something real

    Pick a public repository you have never inspected. Small is better for a first run.

  3. 3

    Confirm the hooks are gone

    ls -la /tmp/first-acquire/.git/hooks should be empty. That is the whole product in one directory listing. A normal clone of the same repository will have sample hooks in there and, from a hostile source, could have live ones.

  4. 4

    Read the report

    Every acquisition writes .securegit-report.json into the destination. Read it the first ten times. After that you will have calibrated intuition for what a normal report looks like.

  5. 5

    Scan something you care about

    Run this in a repository you actually work in. It will finish in seconds on a normal project. If it produced findings you disagree with, that is expected. Go to the troubleshooting scenes.

Verify, acquire, inspect, scan
securegit --version
securegit acquire https://github.com/toml-lang/toml /tmp/first-acquire
ls -la /tmp/first-acquire/.git/hooks
cat /tmp/first-acquire/.securegit-report.json
securegit scan . --fail-on high