Documentation
¶
Index ¶
- Variables
- func BuildEnv(homeDir string) []string
- func ControlForRequirement(requirementID string) string
- func DigestRecordedInState(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func EnvVarResolution(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func EvaluationLogProduced(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func EvaluatorMismatchRejected(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func HTTPSSchemeNoPlainHTTP(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func HTTPSchemeRejected(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func InstallTestPlugin(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func LogCredentialRedaction(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func MatchedEvaluatorRouting(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func OCILayoutExists(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func OSCALResultProduced(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func PluginBinaryIntegrityCheck(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func PluginSubprocessIsolation(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func SignatureVerified(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func StartMockRegistry() *httptest.Server
- func SyncPolicy(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func UnsetEnvVarFails(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- func WriteConfig(payload any) (gemara.Result, string, gemara.ConfidenceLevel)
- type BehavioralContext
Constants ¶
This section is empty.
Variables ¶
var Plans = map[string][]gemara.AssessmentStep{ "CT.COMPLYCTL.CTRL01.AR01": { WriteConfig, SyncPolicy, SignatureVerified, }, "CT.COMPLYCTL.CTRL02.AR01": { WriteConfig, SyncPolicy, DigestRecordedInState, }, "CT.COMPLYCTL.CTRL02.AR02": { WriteConfig, SyncPolicy, OCILayoutExists, }, "CT.COMPLYCTL.CTRL03.AR01": { UnsetEnvVarFails, }, "CT.COMPLYCTL.CTRL03.AR02": { EnvVarResolution, }, "CT.COMPLYCTL.CTRL04.AR01": { WriteConfig, InstallTestPlugin, SyncPolicy, MatchedEvaluatorRouting, }, "CT.COMPLYCTL.CTRL04.AR02": { WriteConfig, InstallTestPlugin, SyncPolicy, EvaluatorMismatchRejected, }, "CT.COMPLYCTL.CTRL05.AR01": { HTTPSchemeRejected, }, "CT.COMPLYCTL.CTRL05.AR02": { HTTPSSchemeNoPlainHTTP, }, "CT.COMPLYCTL.CTRL07.AR01": { WriteConfig, InstallTestPlugin, SyncPolicy, PluginBinaryIntegrityCheck, }, "CT.COMPLYCTL.CTRL08.AR01": { WriteConfig, InstallTestPlugin, PluginSubprocessIsolation, }, "CT.COMPLYCTL.CTRL09.AR01": { LogCredentialRedaction, }, "CT.COMPLYCTL.CTRL06.AR01": { WriteConfig, InstallTestPlugin, SyncPolicy, EvaluationLogProduced, }, "CT.COMPLYCTL.CTRL06.AR02": { WriteConfig, InstallTestPlugin, SyncPolicy, OSCALResultProduced, }, }
Plans maps each assessment requirement ID to its ordered step sequence. Reusable precondition steps (WriteConfig, SyncPolicy, InstallTestPlugin) prepare the shared BehavioralContext before the family-specific evaluator.
Functions ¶
func ControlForRequirement ¶
ControlForRequirement extracts the parent control ID from a requirement ID. "CT.COMPLYCTL.CTRL01.AR01" -> "CT.COMPLYCTL.CTRL01"
func DigestRecordedInState ¶
DigestRecordedInState checks state.json for a sha256 manifest digest recorded for the policy after a successful get (CTRL02.AR01).
func EnvVarResolution ¶
EnvVarResolution verifies ${VAR} references resolve from the process environment at config load time (CTRL03.AR02).
func EvaluationLogProduced ¶
EvaluationLogProduced verifies that scan produces a Gemara evaluation log YAML file in the .complytime/scan output directory (CTRL06.AR01).
func EvaluatorMismatchRejected ¶
EvaluatorMismatchRejected renames the installed test plugin so the evaluator ID no longer matches, then verifies generate fails (CTRL04.AR02).
func HTTPSSchemeNoPlainHTTP ¶
HTTPSSchemeNoPlainHTTP verifies that an https:// registry URL does not enable plainHTTP on the OCI client (CTRL05.AR02).
func HTTPSchemeRejected ¶
HTTPSchemeRejected verifies the CLI rejects registry URLs with http:// scheme and requires https:// or localhost (CTRL05.AR01).
func InstallTestPlugin ¶
InstallTestPlugin copies the test plugin binary into the plugin directory.
func LogCredentialRedaction ¶
LogCredentialRedaction verifies the log file does not contain plaintext values of target variables resolved from environment references (CTRL09.AR01).
func MatchedEvaluatorRouting ¶
MatchedEvaluatorRouting verifies generate routes to the matched plugin when the policy graph specifies an evaluator ID (CTRL04.AR01).
func OCILayoutExists ¶
OCILayoutExists checks the OCI layout directory for the oci-layout marker file (CTRL02.AR02).
func OSCALResultProduced ¶
OSCALResultProduced verifies that scan with --format oscal produces an OSCAL assessment result JSON file (CTRL06.AR02).
func PluginBinaryIntegrityCheck ¶
PluginBinaryIntegrityCheck tests whether the plugin discovery process verifies binary integrity before launching a subprocess (CTRL07.AR01). NOT IMPLEMENTED: discovery matches only on filename prefix and executable bit. This test documents the gap and is expected to fail.
func PluginSubprocessIsolation ¶
PluginSubprocessIsolation tests whether plugin subprocesses run with restricted privileges (CTRL08.AR01). NOT IMPLEMENTED: plugins run with same OS privileges as parent process. This test documents the gap and is expected to fail.
func SignatureVerified ¶
SignatureVerified checks that the get operation verified a cryptographic signature on the fetched policy manifest before caching (CTRL01.AR01). This test is expected to fail until signature validation is implemented. See R20 in specs/001-gemara-native-workflow/research.md for the deferral rationale and threat model.
func StartMockRegistry ¶
StartMockRegistry creates an in-process mock OCI registry implementing the OCI Distribution Spec v2 endpoints with preseeded policy artifacts.
func SyncPolicy ¶
SyncPolicy runs `complyctl get` to pull the policy from the registry.
func UnsetEnvVarFails ¶
UnsetEnvVarFails verifies config loading fails with a descriptive error when a referenced environment variable is not set (CTRL03.AR01).
func WriteConfig ¶
WriteConfig writes a standard complytime.yaml to the context's WorkDir.
Types ¶
type BehavioralContext ¶
type BehavioralContext struct {
Binary string
TestPluginBinary string
HomeDir string
WorkDir string
Env []string
PolicyID string
RegistryURL string
}
BehavioralContext carries the runtime environment needed by behavioral assessment steps. Each step receives this as its payload via the gemara.AssessmentStep interface.
Source Files