boostsecurityio / boostsecurityio/lotp
[LOTP] Add git
- Dominant language
- HTML
- Stars
- 164
- Forks
- 14
- PR merge metrics
- No merged PRs in 30d
Description
# Description of the LOTP tool
`git` is often present in CI pipelines where repos are pulled in at build time. Being able to control `GIT_SSH` or `GIT_SSH_COMMAND` in the pipeline environment variables could result in code execution on build hosts where direct access to the host isn't possible.
[Ref](https://git-scm.com/book/en/v2/Git-Internals-Environment-Variables)
Contributor guide
No contributing guide indexed for this repository
Research direction
The issue names no implementation files or tests. Start by reviewing the LOTP tool's existing integrations and Git's environment-variable reference, especially GIT_SSH and GIT_SSH_COMMAND. Done should include a Git integration that demonstrates the intended pipeline execution behavior and has coverage for the supported variables.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100