compliance

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 30, 2026 License: Apache-2.0 Imports: 8 Imported by: 0

Documentation

Index

Constants

View Source 
const GapSchemaVersion = "agentprovenance.compliance_gaps/v1"
View Source 
const RuleMappingSchemaVersion = "agentprovenance.compliance_rule_mapping/v1"
View Source 
const SchemaVersion = "agentprovenance.compliance_mapping/v1"

Variables

This section is empty.

Functions

This section is empty.

Types

type Control 

type Control struct {
	ID          string   `json:"id" yaml:"id"`
	Title       string   `json:"title" yaml:"title"`
	Description string   `json:"description" yaml:"description"`
	Evidence    []string `json:"evidence" yaml:"evidence"`
	Partial     []string `json:"partial,omitempty" yaml:"partial"`
	NotApplies  []string `json:"not_applicable,omitempty" yaml:"not_applicable"`
	Gap         string   `json:"gap" yaml:"gap"`
	NextStep    string   `json:"recommended_next_step" yaml:"recommended_next_step"`
}

type EvidenceIndex 

type EvidenceIndex struct {
	// contains filtered or unexported fields
}

func ResolveEvidence 

func ResolveEvidence(db *sql.DB, runID string) (EvidenceIndex, error)

func (EvidenceIndex) Refs 

func (i EvidenceIndex) Refs(kinds ...string) []EvidenceRef

func (EvidenceIndex) RequiredRefs 

func (i EvidenceIndex) RequiredRefs(kinds ...string) ([]EvidenceRef, bool)

type EvidenceRef 

type EvidenceRef struct {
	Ref     string `json:"ref"`
	Kind    string `json:"kind"`
	ID      string `json:"id"`
	Summary string `json:"summary,omitempty"`
}

type Framework 

type Framework struct {
	ID          string    `json:"id" yaml:"id"`
	Title       string    `json:"title" yaml:"title"`
	Description string    `json:"description" yaml:"description"`
	Disclaimer  string    `json:"disclaimer" yaml:"disclaimer"`
	Controls    []Control `json:"controls" yaml:"controls"`
}

func Frameworks 

func Frameworks(ruleSets ...RuleSet) []Framework

func GetFramework 

func GetFramework(id string, ruleSets ...RuleSet) (Framework, bool)

type GapReport 

type GapReport struct {
	SchemaVersion string          `json:"schema_version"`
	Framework     string          `json:"framework"`
	FrameworkName string          `json:"framework_name"`
	RunID         string          `json:"run_id"`
	Summary       MappingSummary  `json:"summary"`
	Items         []MappingResult `json:"items"`
}

func Gaps 

func Gaps(report MappingReport, missingOnly bool, limit int) GapReport

type Mapping 

type Mapping struct {
	Framework       string   `json:"framework" yaml:"framework"`
	Rules           []string `json:"rules" yaml:"rules"`
	BuiltinControls []string `json:"builtin_controls" yaml:"builtin_controls"`
}

type MappingOptions 

type MappingOptions struct {
	Framework string
	RunID     string
	RuleSet   *RuleSet
	Only      []string
	Exclude   []string
}

type MappingReport 

type MappingReport struct {
	SchemaVersion string          `json:"schema_version"`
	Framework     string          `json:"framework"`
	FrameworkName string          `json:"framework_name"`
	RunID         string          `json:"run_id"`
	Disclaimer    string          `json:"disclaimer"`
	Summary       MappingSummary  `json:"summary"`
	Items         []MappingResult `json:"items"`
}

func MapRun 

func MapRun(db *sql.DB, opts MappingOptions) (MappingReport, error)

func (MappingReport) JSON 

func (r MappingReport) JSON() ([]byte, error)

type MappingResult 

type MappingResult struct {
	Framework           string        `json:"framework"`
	ItemID              string        `json:"item_id"`
	ControlID           string        `json:"control_id"`
	Title               string        `json:"title"`
	Status              Status        `json:"status"`
	EvidenceRefs        []EvidenceRef `json:"evidence_refs"`
	Gap                 string        `json:"gap"`
	RecommendedNextStep string        `json:"recommended_next_step"`
	Reason              string        `json:"reason"`
}

func FindItem 

func FindItem(report MappingReport, itemID string) (MappingResult, bool)

type MappingSummary 

type MappingSummary struct {
	Covered       int `json:"covered"`
	Partial       int `json:"partial"`
	Missing       int `json:"missing"`
	NotApplicable int `json:"not_applicable"`
	Total         int `json:"total"`
}

type Rule 

type Rule struct {
	ID          string   `json:"id" yaml:"id"`
	Title       string   `json:"title" yaml:"title"`
	Description string   `json:"description" yaml:"description"`
	Evidence    []string `json:"evidence" yaml:"evidence"`
	Partial     []string `json:"partial,omitempty" yaml:"partial"`
	NotApplies  []string `json:"not_applicable,omitempty" yaml:"not_applicable"`
	Gap         string   `json:"gap" yaml:"gap"`
	NextStep    string   `json:"recommended_next_step" yaml:"recommended_next_step"`
}

type RuleControlResult added in v0.4.0 

type RuleControlResult struct {
	ControlID    string        `json:"control_id"`
	Title        string        `json:"title"`
	Description  string        `json:"description"`
	Status       RuleStatus    `json:"status"`
	Rules        []RuleView    `json:"rules"`
	EvidenceRefs []EvidenceRef `json:"evidence_refs"`
	Gap          string        `json:"gap"`
	NextStep     string        `json:"recommended_next_step"`
	Reason       string        `json:"reason"`
}

type RuleMappingOptions added in v0.4.0 

type RuleMappingOptions struct {
	Framework string
	RunID     string
	// Rules is the detection rule set to map from. When nil it defaults to
	// security.DefaultRules(). A deployment running a custom YAML engine should
	// pass that engine's rules so custom rules (with their own controls: tags)
	// participate in the mapping.
	Rules []security.Rule
}

type RuleMappingReport added in v0.4.0 

type RuleMappingReport struct {
	SchemaVersion string              `json:"schema_version"`
	Framework     string              `json:"framework"`
	FrameworkName string              `json:"framework_name"`
	RunID         string              `json:"run_id"`
	Disclaimer    string              `json:"disclaimer"`
	Summary       RuleMappingSummary  `json:"summary"`
	Items         []RuleControlResult `json:"items"`
}

func MapRunRules added in v0.4.0 

func MapRunRules(db *sql.DB, opts RuleMappingOptions) (RuleMappingReport, error)

MapRunRules maps the configured detection rules onto a framework's controls for one run and reports the four-state coverage above.

type RuleMappingSummary added in v0.4.0 

type RuleMappingSummary struct {
	Enforced     int `json:"enforced"`
	Detected     int `json:"detected"`
	NotTriggered int `json:"not_triggered"`
	NoRule       int `json:"no_rule"`
	Total        int `json:"total"`
}

type RuleSet 

type RuleSet struct {
	SchemaVersion string      `json:"schema_version" yaml:"schema_version"`
	ID            string      `json:"id" yaml:"id"`
	Title         string      `json:"title" yaml:"title"`
	Description   string      `json:"description" yaml:"description"`
	Disclaimer    string      `json:"disclaimer" yaml:"disclaimer"`
	Frameworks    []Framework `json:"frameworks" yaml:"frameworks"`
	Rules         []Rule      `json:"rules" yaml:"rules"`
	Mappings      []Mapping   `json:"mappings" yaml:"mappings"`
}

func LoadRuleSet 

func LoadRuleSet(path string) (RuleSet, error)

func (RuleSet) Validate 

func (r RuleSet) Validate() error

type RuleStatus added in v0.4.0 

type RuleStatus string
const (
	RuleStatusEnforced     RuleStatus = "enforced"
	RuleStatusDetected     RuleStatus = "detected"
	RuleStatusNotTriggered RuleStatus = "not_triggered"
	RuleStatusNoRule       RuleStatus = "no_rule"
)

type RuleView added in v0.4.0 

type RuleView struct {
	ID       string `json:"id"`
	Reason   string `json:"reason"`
	Mode     string `json:"mode"`              // enforce | detect
	Intended string `json:"intended_decision"` // deny | quarantine | kill
	Fired    int    `json:"fired"`
	Enforced bool   `json:"enforced"`
}

RuleView is one detection rule mapped to a control, plus how it behaved this run. Mode/Intended come from the rule definition; Fired/Enforced from the run's policy_decisions.

type Status 

type Status string
const (
	StatusCovered       Status = "covered"
	StatusPartial       Status = "partial"
	StatusMissing       Status = "missing"
	StatusNotApplicable Status = "not_applicable"
)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.