boostsecurityio / boostsecurityio/lotp

[LOTP] Add git

Open
#23 1 comment 0 reactions 0 assignees View on GitHub
good first issue idea
Dominant language
HTML
Stars
164
Forks
14
PR merge metrics
No merged PRs in 30d

Description

# Description of the LOTP tool

`git` is often present in CI pipelines where repos are pulled in at build time. Being able to control `GIT_SSH` or `GIT_SSH_COMMAND` in the pipeline environment variables could result in code execution on build hosts where direct access to the host isn't possible.

[Ref](https://git-scm.com/book/en/v2/Git-Internals-Environment-Variables)

Contributor guide

No contributing guide indexed for this repository

Research direction

The issue names no implementation files or tests. Start by reviewing the LOTP tool's existing integrations and Git's environment-variable reference, especially GIT_SSH and GIT_SSH_COMMAND. Done should include a Git integration that demonstrates the intended pipeline execution behavior and has coverage for the supported variables.

Written by the indexing model from the issue text.

Assessment

Tech stack
git
Domain
devops, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.