Documentation
¶
Overview ¶
Package controllers holds Draugr's built-in controllers (e.g. images, sast, opensource, dast), each orchestrating scanners for one security control.
See docs/ARCHITECTURE.md.
Index ¶
- func NewHeaders() plugin.Controller
- func NewIAC() plugin.Controller
- func NewImages() plugin.Controller
- func NewSAST() plugin.Controller
- func NewSCA() plugin.Controller
- func NewSecrets() plugin.Controller
- func SASTScannerSet(model saga.Model) map[string]bool
- func SeverityFloor(control string) sarif.Severity
- type Headers
- type IAC
- type Images
- type SAST
- type SCA
- type Secrets
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewHeaders ¶ added in v0.9.0
func NewHeaders() plugin.Controller
NewHeaders returns the headers controller.
func NewSAST ¶ added in v0.3.0
func NewSAST() plugin.Controller
NewSAST returns the sast controller.
func NewSecrets ¶ added in v0.2.0
func NewSecrets() plugin.Controller
NewSecrets returns the secrets controller.
func SASTScannerSet ¶ added in v0.14.0
SASTScannerSet returns the set of sast scanner names the model will actually run — the union of the selection across all components (each resolved against its override / the project default). Used to decide which sast tools are truly required (e.g. gosec only when selected), rather than every scanner that *could* serve the control.
func SeverityFloor ¶ added in v0.5.0
SeverityFloor returns the minimum normalized severity for a control's findings, or an empty severity (no floor) when the control declares none. Used by prioritization when resolving a finding's severity.
Types ¶
type Headers ¶ added in v0.9.0
type Headers struct{}
Headers is the HTTP security-header control. It plans one native header scan per host declared on a component and aggregates the findings. No external tool is required.
func (Headers) Aggregate ¶ added in v0.9.0
Aggregate merges the scan reports and summarizes findings by severity.
func (Headers) Info ¶ added in v0.9.0
func (Headers) Info() plugin.ControllerInfo
Info identifies the controller (component-scoped).
type IAC ¶ added in v0.4.0
type IAC struct{}
IAC is the Infrastructure-as-Code / misconfiguration control: it scans a component's repositories for insecure IaC (Terraform, Kubernetes manifests, Dockerfiles, …). It plans one scan per repository.
func (IAC) Aggregate ¶ added in v0.4.0
Aggregate merges the scan reports and summarizes findings by severity. Trivy reports per-check severity, so severity is taken as reported.
func (IAC) Info ¶ added in v0.4.0
func (IAC) Info() plugin.ControllerInfo
Info identifies the controller (component-scoped).
type Images ¶
type Images struct{}
Images is the container-image security control. It plans one Trivy scan per image in a component and aggregates the results.
func (Images) Info ¶
func (Images) Info() plugin.ControllerInfo
Info identifies the controller (component-scoped).
type SAST ¶ added in v0.3.0
type SAST struct{}
SAST is the Static Application Security Testing control: it analyzes a component's own source code (not its dependencies) for security bugs. It plans one scan per repository, per selected scanner.
func (SAST) Aggregate ¶ added in v0.3.0
Aggregate merges the scan reports and summarizes findings by severity. Semgrep emits per-rule SARIF levels, so severity is taken as reported.
func (SAST) Info ¶ added in v0.3.0
func (SAST) Info() plugin.ControllerInfo
Info identifies the controller (component-scoped).
type SCA ¶
type SCA struct{}
SCA is the Software Composition Analysis control: dependency vulnerabilities (and, later, licenses) for a component's source repositories. It plans one scan per repository.
func (SCA) Info ¶
func (SCA) Info() plugin.ControllerInfo
Info identifies the controller (component-scoped).
type Secrets ¶ added in v0.2.0
type Secrets struct{}
Secrets is the secret-detection control: it scans a component's repositories for leaked credentials. Any detected secret is treated as an error — a leaked secret should fail the gate regardless of how the scanner rated it.
func (Secrets) Aggregate ¶ added in v0.2.0
Aggregate merges the scan reports and escalates every finding to error severity — a detected secret is always gate-failing.
func (Secrets) Info ¶ added in v0.2.0
func (Secrets) Info() plugin.ControllerInfo
Info identifies the controller (component-scoped).
Source Files