octoscope 0.27.0 — the scan stops describing and starts noticing
octoscope 0.27.0 — the integrity scan stops describing a repo and starts noticing things about it.
Before this release the supply-chain scan could only talk in the present tense: here is what auto-executes right now, here is a commit tip that looks forged. Useful if you happen to scan while the implant is sitting there. Useless for the two questions you actually have when a worm is circulating — did something change, and what could whoever got in reach?
Now: every scan records a fingerprint of what auto-executes in the repo, and the next one tells you what moved. A file that auto-executes appeared. An existing one's contents changed. A branch tip that used to be signed no longer is. It survives renames and re-obfuscation, because a variant still has to appear — and appearing is the thing being watched.
It also maps your capability footprint: workflow permissions and triggers, self-hosted runners, write deploy keys, webhooks delivering somewhere other than GitHub.
A tip that is really a design note: holding power is not a finding. My own release workflow asks for contents:write and reads two secrets, and it is correct — it fires on a tag push, so only someone who can already push tags can reach it. What scores is power reachable from untrusted input: a pull_request_target workflow holding your secrets, or a self-hosted runner an outsider's pull request can actually target. Scoring power by itself would flag a large share of GitHub and teach everyone to ignore the whole thing.
The detail I enjoyed getting right: the first scan of a repo says so out loud. There is no baseline yet, so there is nothing to compare — and staying quiet there would be indistinguishable from "nothing changed". A security tool that cannot tell you the difference between "I looked and it is fine" and "I had nothing to look at" is worse than one that admits it. The same reasoning made the checks needing admin scope fail open but still name themselves: "deploy keys (the token lacks the scope this needs)".
brew upgrade gfazioli/tap/octoscopeSo: how would you find out today that something which auto-executes changed in one of your repos? I keep asking people this and the honest answer is usually "I wouldn't". Curious whether that matches your experience.
https://gfazioli.github.io/octoscope
Replies