Add CIS audit, HTML scorecard, and headless agent; fix CI lint - #16
Merged
Conversation
Port three features from the macbook_fingerprint repo into the packaged
macos_fingerprint layout as a new `audit` subpackage:
- audit/cis.py: scored CIS macOS benchmark (23 Level-1 controls) with
per-control remediation; indeterminate checks are excluded from the score.
- audit/html_report.py: self-contained, shareable HTML scorecard.
- audit/agent.py: launchd monitoring agent with a hash-chained,
tamper-evident history log.
Wire `audit` and `agent` subcommands into the CLI and add tests for all
three modules (+23 tests).
Adaptations vs the source repo: run_command returns None (not an
"<unavailable>" sentinel) on failure, and compare_fingerprints() returns
{"summary","changes"} so drift reads ["changes"].keys(). The agent invokes
`python -m macos_fingerprint agent run`.
Also fix pre-existing CI failures on main: ruff E402/unused-import errors,
a mypy assignment error in cli.py, black formatting across 11 files, and a
test that hardcoded /tmp instead of its realpath (/private/tmp on macOS).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates the two fingerprint repos by porting three features from
macbook_fingerprintinto this repo's packaged layout, and fixes the CI failures that were already onmain.New:
auditsubpackageaudit/cis.py— scored CIS macOS benchmark (23 Level-1 controls), each failing control carries its exact remediation. Indeterminate checks (no privileges / not macOS) are excluded from the score rather than counted as passes.audit/html_report.py— self-contained, shareable HTML scorecard (inline CSS, light/dark).audit/agent.py— launchd monitoring agent with a hash-chained, tamper-evident history log (a silently edited/deleted record breaks the chain).New CLI subcommands
macos-fingerprint audit [--level 1|2] [--format text|json|html] [-o FILE]— exits non-zero if any determinable check fails (CI-friendly).macos-fingerprint agent {run,history,verify,install,uninstall}— headless scheduled monitoring.CI fixes (main was red)
cli.pyblackformatting across 11 files/tmpinstead of its realpath (/private/tmpon macOS)Adaptations vs source repo
run_commandreturnsNone(not a"<unavailable>"sentinel) on failure.compare_fingerprints()returns{"summary","changes"}, so drift reads["changes"].keys().python -m macos_fingerprint agent run.Testing
test_cis_audit,test_html_report,test_agent).auditscored the machine, HTML export, andagent runrecorded a real cycle with drift detection against a baseline.Follow-up
Archive the old repo once merged:
gh repo archive star7js/macbook_fingerprint🤖 Generated with Claude Code