TMA-GITHUB-1.1.12
Ensure verification of signed commits for new changes before merging
Beschreibung
Ensure every commit in a pull request is signed and verified before merging. Signing commits, or requiring to sign commits, gives other users confidence about the origin of a specific code change. It ensures that the author of the change is not hidden and is verified by the version control ... Checks the default branch: signed commits are required. Satisfied by classic branch protection or an active ruleset (rules/branches). Uses the GitHub REST/GraphQL API through gh api (read-only). The repository comes from GH_REPO or the current git checkout (gh's {owner}/{repo} resolution, GH_HOST for GitHub Enterprise Server); the organization comes from GH_ORG (default: the repository owner). Fails when gh is missing or unauthenticated (gh auth login or GH_TOKEN); organization settings and branch protection need an owner/admin token.
So wird geprüft
Prüfmethode: Shell-Befehl
command -v gh >/dev/null 2>&1 || exit 1
gh auth status >/dev/null 2>&1 || exit 1
info=$(gh api 'repos/{owner}/{repo}' --jq '.full_name + " " + .default_branch' 2>/dev/null) || exit 1
R=${info% *}; B=${info#* }
[ -n "$R" ] && [ -n "$B" ] || exit 1
p=$(gh api "repos/$R/branches/$B/protection" --jq '.required_signatures.enabled == true' 2>/dev/null) || p=false
s=$(gh api "repos/$R/rules/branches/$B" --jq 'any(.[]; .type == "required_signatures")' 2>/dev/null) || s=false
[ "$p" = true ] || [ "$s" = true ] && echo compliant- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Settings > Branches (or Rules > Rulesets) for the default branch: enable Require signed commits.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- githubsource-code
- Referenz
- CIS GitHub Benchmark v1.2.0 - 1.1.12 Ensure verification of signed commits for new changes before merging
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target github --level 2