Git 审计与合规最佳实践 | 极客日志

Git 审计与合规最佳实践 | 极客日志

# 示例：查看详细的提交历史
git log --pretty=format:"%H|%an|%ad|%s|%P" --date=iso --all

# 配置 GPG 签名
git config --global user.signingkey YOUR_GPG_KEY_ID
git config --global commit.gpgsign true
# 提交并签名
git commit -S -m "Your commit message"

#!/bin/bash
# pre-receive 钩子示例：检查提交者是否在允许列表中
# 获取推送信息
while read oldrev newrev refname; do
    # 获取提交列表
    commits=$(git rev-list $oldrev..$newrev)
    for commit in $commits; do
        author=$(git log --format="%ae" -n1 $commit)
        # 检查作者邮箱是否在允许列表中
        if ! grep -q "$author" /path/to/allowed_users.txt; then
            echo "错误：提交 $commit 来自未授权用户 $author"
            exit 1
        fi
    done
done

#!/bin/bash
# post-receive 钩子示例：记录审计日志并触发通知
while read oldrev newrev refname; do
    # 记录到审计日志
    echo "$(date '+%Y-%m-%d %H:%M:%S') | 推送到 $refname | $oldrev..$newrev" >> /var/log/git_audit.log
    # 触发通知（示例：发送到 Slack）
    if command -v slack-notify >/dev/null 2>&1; then
        slack-notify -c "#devops" "代码已推送到 $refname: $newrev"
    fi
done

# 在 gitlab.rb 中配置审计
gitlab_rails['audit_events'] = {
  enabled: true,
  upload: {
    remote_directory: 'audit',
    connection: {
      provider: 'AWS',
      region: 'us-east-1',
      aws_access_key_id: 'YOUR_ACCESS_KEY',
      aws_secret_access_key: 'YOUR_SECRET_KEY'
    }
  }
}

# .gitlab-ci.yml 示例：集成 SAST 扫描
stages:
  - test
  - security

sast_scan:
  stage: security
  image: docker:latest
  services:
    - docker:dind
  script:
    - docker run --rm -v "$PWD:/code" -w /code codeclimate analyze
  only:
    - merge_requests
    - master

合规框架	关键要求	实现方法
SOX	完整的变更追踪、职责分离	签名提交、强制审查
GDPR	个人数据访问追踪	代码扫描、数据分类
HIPAA	完整审计日志、访问控制	详细的 pre-receive 钩子

# Python 脚本：检查提交是否包含敏感信息
import re
import sys
import subprocess

def check_sensitive_data(commit_hash):
    # 获取提交内容
    commit_content = subprocess.check_output(['git', 'show', commit_hash], universal_newlines=True)
    # 检查敏感模式
    sensitive_patterns = [
        r'\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b',  # 信用卡号
        r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b',  # 邮箱
        r'password[=:]\s*[\'"]\w+[\'"]'  # 密码
    ]
    for pattern in sensitive_patterns:
        if re.search(pattern, commit_content):
            return True
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python check_sensitive.py <commit_hash>")
        sys.exit(1)
    commit_hash = sys.argv[1]
    if check_sensitive_data(commit_hash):
        print(f"警告：提交 {commit_hash} 可能包含敏感信息")
        sys.exit(1)
    else:
        print(f"提交 {commit_hash} 通过安全检查")

#!/bin/bash
# 生成月度审计报告脚本
# 配置变量
REPO_PATH="/path/to/your/repo"
REPORT_DIR="/var/reports/git_audit"
MONTH=$(date +%Y-%m)

# 创建报告目录
mkdir -p "$REPORT_DIR"

# 生成提交统计
git -C "$REPO_PATH" log --since="1 month ago" --pretty=format:"%H|%an|%ad|%s" --date=short > "$REPORT_DIR/commits_$MONTH.txt"

# 生成作者统计
git -C "$REPO_PATH" log --since="1 month ago" --format="%ae" | sort | uniq -c > "$REPORT_DIR/authors_$MONTH.txt"

# 生成分支统计
git -C "$REPO_PATH" branch -r --merged master | grep -v master > "$REPORT_DIR/merged_branches_$MONTH.txt"

# 生成报告摘要
echo "Git 审计报告 - $MONTH" > "$REPORT_DIR/summary_$MONTH.txt"
echo "====================" >> "$REPORT_DIR/summary_$MONTH.txt"
echo "总提交数：$(wc -l < "$REPORT_DIR/commits_$MONTH.txt")" >> "$REPORT_DIR/summary_$MONTH.txt"
echo "活跃作者数：$(wc -l < "$REPORT_DIR/authors_$MONTH.txt")" >> "$REPORT_DIR/summary_$MONTH.txt"
echo "已合并分支数：$(wc -l < "$REPORT_DIR/merged_branches_$MONTH.txt")" >> "$REPORT_DIR/summary_$MONTH.txt"

# 发送报告（示例）
mail -s "Git 审计报告 - $MONTH" [email protected] < "$REPORT_DIR/summary_$MONTH.txt"