Security & Compliance

#!/bin/bash
# Enterprise compliance reporting script

REPORT_DATE=$(date +%Y-%m-%d)
REPORT_DIR="compliance-reports/$REPORT_DATE"
mkdir -p "$REPORT_DIR"

# Signature verification report
echo "=== GPG Signature Compliance Report ===" > "$REPORT_DIR/signature-report.txt"
echo "Report Date: $REPORT_DATE" >> "$REPORT_DIR/signature-report.txt"
echo "" >> "$REPORT_DIR/signature-report.txt"

# Check last 30 days of commits
git log --since="30 days ago" --format="%H|%an|%ae|%ad|%G?" --date=iso-strict > temp-commits.log

# Count signature status
TOTAL_COMMITS=$(wc -l < temp-commits.log)
SIGNED_COMMITS=$(grep -c "|G$" temp-commits.log)
UNSIGNED_COMMITS=$(grep -c "|N$" temp-commits.log)
BAD_SIGNATURE=$(grep -c "|B$" temp-commits.log)

echo "Total Commits (30 days): $TOTAL_COMMITS" >> "$REPORT_DIR/signature-report.txt"
echo "Signed Commits: $SIGNED_COMMITS ($(( SIGNED_COMMITS * 100 / TOTAL_COMMITS ))%)" >> "$REPORT_DIR/signature-report.txt"
echo "Unsigned Commits: $UNSIGNED_COMMITS" >> "$REPORT_DIR/signature-report.txt"
echo "Bad Signatures: $BAD_SIGNATURE" >> "$REPORT_DIR/signature-report.txt"

# Detailed unsigned commits
if [ $UNSIGNED_COMMITS -gt 0 ]; then
    echo "" >> "$REPORT_DIR/signature-report.txt"
    echo "=== UNSIGNED COMMITS (COMPLIANCE VIOLATION) ===" >> "$REPORT_DIR/signature-report.txt"
    grep "|N$" temp-commits.log >> "$REPORT_DIR/signature-report.txt"
fi

# Access pattern analysis
echo "=== Access Pattern Analysis ===" > "$REPORT_DIR/access-report.txt"
git log --since="30 days ago" --format="%an|%ae|%ad" --date=iso-strict | \
    sort | uniq -c | sort -nr >> "$REPORT_DIR/access-report.txt"

# Security events
echo "=== Security-Related Changes ===" > "$REPORT_DIR/security-events.txt"
git log --since="30 days ago" --grep="security\|auth\|login\|password\|token\|credential" \
    --format="%H|%an|%ad|%s" --date=iso-strict >> "$REPORT_DIR/security-events.txt"

rm temp-commits.log
echo "Compliance reports generated in $REPORT_DIR"

#!/bin/bash
# Real-time security monitoring

# Check for unsigned commits in last hour
UNSIGNED_RECENT=$(git log --since="1 hour ago" --format="%H|%an|%G?" | grep "|N$" | wc -l)

if [ $UNSIGNED_RECENT -gt 0 ]; then
    # Send alert to security team
    curl -X POST "https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK" \
         -H 'Content-type: application/json' \
         --data '{
           "text": "🚨 SECURITY ALERT: '"$UNSIGNED_RECENT"' unsigned commits detected in repository",
           "channel": "#security-alerts",
           "username": "Git Security Monitor"
         }'
    
    # Log security event
    echo "$(date -u +%Y-%m-%dT%H:%M:%SZ)|UNSIGNED_COMMIT_ALERT|$UNSIGNED_RECENT commits" >> /var/log/git-security.log
fi

# Check for suspicious access patterns
FAILED_AUTHS=$(grep "authentication failure" /var/log/auth.log | tail -n 100 | wc -l)
if [ $FAILED_AUTHS -gt 10 ]; then
    echo "$(date -u +%Y-%m-%dT%H:%M:%SZ)|SUSPICIOUS_ACCESS|$FAILED_AUTHS failed attempts" >> /var/log/git-security.log
fi