macOS
Homebrew已验证 · 100%
brew install legitifylocal Homebrew formula metadata
安装
其他安装命令
Linux
Nix已验证 · 92%
nix profile install nixpkgs#legitifynixpkgs package indexes · pkgs/by-name/le/legitify/package.nix · 来源: api.github.com
概览
软件包摘要
Tool to detect/remediate misconfig and security risks of GitHub/GitLab assets
历史
项目历史与用法
Legitify is Legit Security's open-source CLI for finding and helping remediate security, compliance, and misconfiguration risks across GitHub and GitLab assets.
项目历史
Legit Security announced Legitify on 2022-10-05 as an open-source GitHub configuration scanner for security, DevOps, and developer teams. The repository and project site later described the scope as source-code-management posture across GitHub and GitLab assets, with built-in policies and remediation-oriented output.
采用历史
The project was packaged as a standalone CLI, GitHub Action, Homebrew formula, Nix package, and GitHub CLI extension. That mix made it fit both one-off audits from a workstation and scheduled checks in CI for organizations managing many repositories, members, teams, runners, branch protections, and tokens.
使用方式
Typical usage is to authenticate to GitHub or GitLab, run `legitify analyze`, and review policy findings against repositories, organizations, runners, webhooks, actions, branch protection, and other SCM resources. Its Homebrew packaging matters because security teams can hand developers a familiar install path instead of a vendor-only SaaS workflow.
为什么软件包爱好者会关心
Legitify is a package-nerd example of application-security posture management ideas escaping into a plain CLI. It packages policy checks and remediation hints as a tool that can live in local shells, CI jobs, and GitHub Actions, adjacent to linters and secret scanners.
时间线
- 2022-07-26: The GitHub issue tracker showed early public project activity.
- 2022-10-05: Legit Security published the introductory Legitify announcement.
- 2023-01-19: Public issues tracked expansion into third-party application policies.
- 2023-02-06: Public issues tracked auto-remediation work.
Related projects
- Related projects include the `gh-legitify` GitHub CLI extension, the Legitify GitHub Action, OpenSSF Scorecard, GitHub Advanced Security configuration checks, GitLab security scanners, and policy-as-code tools used for SCM governance.
来源
安全态势
风险级别：blue
broad file, network, media, or database tool signal.
风险分类器
blue 风险 · 中 置信度 · tool
原因
- broad file, network, media, or database tool signal
信号
- text:media
安装行为
- formula 元数据中未记录 Homebrew post-install 钩子。
- Homebrew bottle 元数据适用于 6 个平台目标。
- 构建元数据列出 1 个构建依赖。
建议审查
在无人值守的代理使用前，请检查该工具是否读取明文凭据、写入远程状态、发布制品或调用插件。
可执行文件
已安装的可执行文件
| 命令 | 类型 | 暴露范围 | 备注 |
|---|---|---|---|
legitify | cli | 全局可执行文件 |
新鲜度
版本和新鲜度
这些信号区分页生成时间、软件包管理器活动和上游发布比较。只有存在证据 URL 和可比较版本时，才会提示版本落后。
页面生成时间2026-07-25
管理器版本1.0.11
管理器更新时间2026-05-19
本地数据OK
上游当前
检测到的最新版本v1.0.11
https://github.com/Legit-Labs/legitify
- OK没有生成新鲜度警告。
安装元数据
软件包元数据
| 软件包键 | brew:legitify |
|---|---|
| 版本 | 1.0.11 |
| 软件包管理器 | Homebrew |
| 软件包管理器页面 | https://formulae.brew.sh/formula/legitify |
| 主页 | https://legitify.dev/ |
| 仓库 | https://github.com/Legit-Labs/legitify |
| 上游文档 | https://legitify.dev/ |
| 许可证 | Apache-2.0 |
| 源码归档 | https://github.com/Legit-Labs/legitify/archive/refs/tags/v1.0.11.tar.gz |
| 最后更新 | 2026-05-19T13:03:29-04:00 |
| Pulse | updated |
| 构建依赖 | go@1.24 |
| Bottle | 可用 (于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | 未定义 |
| 服务 | 未声明 |
注册表事实
源数据库详情
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | legitify |
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | yes |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
源数据库匹配
其他软件包管理器记录
匹配项来自外部软件包管理器索引，并与本地 Automic Vault 软件包链接分开显示。
Nix95%
legitify
nix profile install nixpkgs#legitify- normalized package name match
- 匹配方式：Legitify
来源线索
由仓库数据生成
此页面由 av-web 从 scripts/generate-pkg-sqlite.py 生成的私有软件包 SQLite 工件提供。
Combined YAML source
View the package source record on GitHub.
使用的来源
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment