Skip to content

Commit 0f852f1

Browse files
committed
Corrected any references to "GitHub" which did not have a capital H
1 parent aa21e89 commit 0f852f1

3 files changed

Lines changed: 9 additions & 9 deletions

File tree

docs/vulnerable_workflows.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Either way, here's a list of specialized software and documentation on how to pr
1414

1515
* [https://github.com/tindersec/gh-workflow-auditor](https://github.com/tindersec/gh-workflow-auditor) - A script by Tinder Security which analyzes multiple aspects of a Workflow.
1616

17-
# Articles about Github Workflows and Security
17+
# Articles about GitHub Workflows and Security
1818

1919
## Official by GitHub
2020

src/gitxray/include/gx_definitions.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
ENV_GITHUB_TOKEN = "GH_ACCESS_TOKEN"
33

44
# GitHub has historically signed commits made via its web editor with a Key that expired in 2024
5-
# The latest Key however has no expiration set. The "web-flow" Github account owns these keys:
5+
# The latest Key however has no expiration set. The "web-flow" GitHub account owns these keys:
66
# GitHub (web-flow commit signing) <noreply@github.com>
77
# https://api.github.com/users/web-flow/gpg_keys
88
GITHUB_WEB_EDITOR_SIGNING_KEYS = ['4AEE18F83AFDEB23', 'B5690EEEBB952194']

src/gitxray/xrays/contributors_xray.py

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,9 @@ def run(gx_context, gx_output):
5353
raise Exception("Contributor of Type !== User/Anonymous found. Failing almost gracefully")
5454

5555
if contributor_scope == None:
56-
print(f"\r\nDiscovered {len(c_users)} contributors with Github User accounts, and {len(c_anon)} Anonymous contributors", end='', flush=True)
56+
print(f"\r\nDiscovered {len(c_users)} contributors with GitHub User accounts, and {len(c_anon)} Anonymous contributors", end='', flush=True)
5757
gx_output.r_log(f"Repository has {len(c_anon)} Anonymous contributors.", rtype="contributors")
58-
gx_output.r_log(f"Repository has {len(c_users)} contributors with Github User accounts.", rtype="contributors")
58+
gx_output.r_log(f"Repository has {len(c_users)} contributors with GitHub User accounts.", rtype="contributors")
5959

6060
print(f"\r\nPlease wait, beginning to collect keys and commits for User contributors..", end='', flush=True)
6161

@@ -204,7 +204,7 @@ def run(gx_context, gx_output):
204204
unique_pgp_sct = set(attribute.get('pgp_signature_creation_time') for attribute in signature_attributes if attribute.get('pgp_signature_creation_time') is not None)
205205
unique_pgp_keyids = set(attribute.get('pgp_keyid') for attribute in signature_attributes if attribute.get('pgp_keyid') is not None)
206206

207-
# We don't link SSH Key IDs because SSH keys are unique across Github; PGP keys can be added to more than 1 account.
207+
# We don't link SSH Key IDs because SSH keys are unique across GitHub; PGP keys can be added to more than 1 account.
208208
gx_context.linkIdentifier("PGP_KEYID", unique_pgp_keyids, contributor_login)
209209
gx_context.linkIdentifier("PGP_PKA", unique_pgp_pka, contributor_login)
210210
gx_context.linkIdentifier("PGP_HA", unique_pgp_ha, contributor_login)
@@ -228,7 +228,7 @@ def run(gx_context, gx_output):
228228

229229

230230
# https://docs.github.com/en/rest/users/gpg-keys?apiVersion=2022-11-28#list-gpg-keys-for-a-user
231-
# Github calls them GPG keys, but we're going to refer to them as PGP for the OpenPGP standard
231+
# GitHub calls them GPG keys, but we're going to refer to them as PGP for the OpenPGP standard
232232
pgp_keys = gh_api.fetch_gpg_keys(contributor_login)
233233
if pgp_keys != None and len(pgp_keys) > 0:
234234
primary_key_ids = [key.get('key_id') for key in pgp_keys]
@@ -334,12 +334,12 @@ def run(gx_context, gx_output):
334334
# Unique key ids for now only holds keys we've extracted from commit signatures
335335
if len(unique_pgp_keyids) > 0:
336336
# https://docs.github.com/en/rest/search/search?apiVersion=2022-11-28#constructing-a-search-query
337-
# Unfortunately Github requires (for other users than our own) to provide (non-regex) input keywords in order to
337+
# Unfortunately GitHub requires (for other users than our own) to provide (non-regex) input keywords in order to
338338
# return results in the commits API which accept filtering such as is:signed - and input keywords restrict our results.
339339
gx_output.c_log(f"{len(unique_pgp_keyids)} Keys ({unique_pgp_keyids}) were used by this contributor when signing commits.", rtype="keys")
340340
github_keys_used = [keyid for keyid in unique_pgp_keyids if keyid in gx_definitions.GITHUB_WEB_EDITOR_SIGNING_KEYS]
341341
if len(github_keys_used) > 0:
342-
gx_output.c_log(f"{len(github_keys_used)} of the keys used to sign commits belong to Github's Web editor {github_keys_used}", rtype="keys")
342+
gx_output.c_log(f"{len(github_keys_used)} of the keys used to sign commits belong to GitHub's Web editor {github_keys_used}", rtype="keys")
343343

344344
if len(commits) == len(signed_commits):
345345
gx_output.c_log(f"Contributor has signed all of their {len(signed_commits)} total commits (to this repo).", rtype="signatures")
@@ -383,7 +383,7 @@ def run(gx_context, gx_output):
383383
gx_output.c_log(f"X-Ray on contributor ended at {c_ended_at} - {(c_ended_at-c_started_at).seconds} seconds elapsed", rtype="metrics")
384384

385385
# Let's first create a dictionary merging by email - this is because duplicate anonymous are "normal" or regularly seen
386-
# Github checks if any of (email OR name) differ and if so treats the anonymous user as different
386+
# GitHub checks if any of (email OR name) differ and if so treats the anonymous user as different
387387
# Add all of these under Anonymous contributor output
388388
unique_anonymous = {}
389389
for ac in c_anon:

0 commit comments

Comments
 (0)