9 steps to write a security script

Quick reference

Spec — Decide what the check decides

# Write the help text first; it fixes the interface.
$python3 audit.py --help
# One dirty fixture, smaller than the real file.
$printf 'root ALL=(ALL) ALL\n' > /tmp/f
# Read the real line shape before the parser.
$grep -n 'NOPASSWD' /tmp/f

Build — Make the smallest correct pass

# Compile after every change; syntax is not a test.
$python3 -m py_compile audit.py
# Run on the dirty fixture until exit 1 is stable.
$python3 audit.py /tmp/f
# Then the clean one; it must exit 0 and print OK.
$python3 audit.py /tmp/clean

Prove — Prove the failure paths

# Missing input must print 2, not a traceback.
$python3 audit.py /tmp/missing; echo $?
# stdout is the report; the exit code is the result.
$python3 audit.py /tmp/f >/dev/null; echo $?
# Run it the way production will run it.
$crontab -l | python3 audit.py -

Explained

Spec

python3 audit.py --help comes first. Write the help text before the code, because it fixes the input, the flags and the exit codes. printf 'root ALL=(ALL) ALL\n' > /tmp/f builds one dirty fixture, smaller than production and safe to break. grep -n 'NOPASSWD' /tmp/f reads the real line shape before a parser assumes it.

Build

python3 -m py_compile audit.py catches syntax, not logic, so run it after every change. python3 audit.py /tmp/f runs on the dirty fixture until exit 1 is stable. python3 audit.py /tmp/clean then proves the clean path: exit 0 and one OK line. The two exits tell CI everything it needs.

Prove

python3 audit.py /tmp/missing; echo $? must print 2, not a traceback. python3 audit.py /tmp/f >/dev/null; echo $? separates the report from the result, which is how CI reads it. crontab -l | python3 audit.py - runs it the way production will, through stdin.

In one line

Start with --help

$python3 audit.py --help