|
1 | | -## Install |
| 1 | +# SECOMlint |
| 2 | + |
| 3 | +Linter to infer compliance against [SECOM](https://tqrg.github.io/secom/) convention. SECOM is a convention for securty commit messages. |
| 4 | + |
| 5 | +## Installation |
| 6 | + |
| 7 | +``` |
| 8 | +pip install secomlint |
| 9 | +python -m spacy download en_core_web_lg |
| 10 | +``` |
| 11 | + |
| 12 | +## Usage |
2 | 13 |
|
3 | 14 | ``` |
4 | | -pip install . |
| 15 | +secomlint --help |
| 16 | +``` |
| 17 | +``` |
| 18 | +Usage: secomlint [OPTIONS] |
| 19 | +
|
| 20 | + Linter to check compliance against SECOM (https://tqrg.github.io/secom/). |
| 21 | +
|
| 22 | +Options: |
| 23 | + --no-compliance Show missing compliance. |
| 24 | + --is-body-informative Checks body for security information. |
| 25 | + --score Show compliance score. |
| 26 | + --config TEXT Rule configuration file path name. |
| 27 | + --help Show this message and exit. |
5 | 28 | ``` |
6 | 29 |
|
7 | 30 | ## Run tool |
8 | 31 |
|
| 32 | +`git log -1 --pretty=%B | secomlint` where `git log -1 --pretty=%B` gets the commit message of the local commit. |
| 33 | + |
| 34 | + |
| 35 | + |
| 36 | +* Check only the rules that are not in compliance: `git log -1 --pretty=%B | secomlint --no-compliance` |
| 37 | +* Calculate compliance score: `git log -1 --pretty=%B | secomlint --no-compliance --score` |
| 38 | + |
| 39 | +## Configuration |
| 40 | + |
| 41 | +The linter has a default configuration that can be overridden with a `.yml` file using the following syntax: |
| 42 | + |
| 43 | +``` |
| 44 | +rule_name: |
| 45 | + active: {true | false} |
| 46 | + type: {0 - warning | 1 - error} |
| 47 | + value: {string | regex} |
| 48 | +``` |
| 49 | + |
| 50 | +An example would be: |
| 51 | + |
| 52 | +``` |
| 53 | +header_starts_with_type: |
| 54 | + active: true |
| 55 | + type: 0 |
| 56 | + value: 'fix' |
| 57 | +metadata_has_detection: |
| 58 | + active: false |
| 59 | +``` |
| 60 | +The rule `header_starts_with_type` is active, outputs warnings and checks if header starts with type `fix`. |
| 61 | + |
| 62 | +The rule `metadata_has_detection` was deactivated. |
| 63 | + |
| 64 | +``` |
| 65 | +git log -1 --pretty=%B | secomlint --config=config.yml |
| 66 | +``` |
| 67 | + |
| 68 | +## Check if your body is informative |
| 69 | + |
| 70 | +It is important that the body of security commit messages are somehow informative; secomlint checks your body for security-related keywords. |
| 71 | + |
| 72 | +``` |
| 73 | +git log -1 --pretty=%B | secomlint --is-body-informative |
| 74 | +``` |
9 | 75 | ``` |
10 | | -git log -1 --pretty=%B | secomlint |
| 76 | +👍 Good to go! Extractor found the following security related words in the message's body: |
| 77 | + - protocols |
11 | 78 | ``` |
0 commit comments