Documentation
¶
Overview ¶
Package saga defines the Draugr descriptor ("Saga") — the declarative account of an application's security surface (repositories, images, hosts, infrastructure) plus the controller configuration that drives a scan. It also handles parsing, validation, env-var substitution, and assembly of distributed meta-sources.
See docs/ARCHITECTURE.md and docs/naming.md.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var Criticalities = []Criticality{CriticalityBC1, CriticalityBC2, CriticalityBC3}
Criticalities lists the valid criticality levels, most to least critical.
var Exposures = []Exposure{ExposureRE1, ExposureRE2, ExposureRE3, ExposureRE4}
Exposures lists the valid exposure levels, most to least exposed.
Functions ¶
This section is empty.
Types ¶
type Component ¶
type Component struct {
Name string `yaml:"name"`
Labels map[string]string `yaml:"labels,omitempty"`
Exposure Exposure `yaml:"exposure,omitempty"`
Criticality Criticality `yaml:"criticality,omitempty"`
Repositories []Repository `yaml:"repositories,omitempty"`
Images []Image `yaml:"images,omitempty"`
Hosts []Host `yaml:"hosts,omitempty"`
Infrastructure []Infrastructure `yaml:"infrastructure,omitempty"`
Controllers map[string]ControllerSettings `yaml:"controllers,omitempty"`
}
Component is one logical part of an application: its repositories, images, hosts, and infrastructure, plus optional per-component controller overrides and risk classification.
type Config ¶
type Config struct {
Controllers map[string]ControllerSettings `yaml:"controllers,omitempty"`
}
Config holds global, per-controller configuration. Each controller's config tree is free-form (scanner-specific keys live under it); use ControllerEnabled to read the common "enabled" flag.
func (Config) ControllerEnabled ¶
ControllerEnabled reports whether the named controller is enabled at the project level. A controller is enabled when its config entry exists and its "enabled" key is not explicitly false. Absent entries are considered disabled.
type ControllerSettings ¶
ControllerSettings is a free-form configuration tree for one controller.
type Criticality ¶ added in v0.5.0
type Criticality string
Criticality is a component's business-criticality level — the operational impact if it fails or is compromised. It is the other axis of risk prioritization and is always human-declared, as it cannot be inferred from code. The levels are a fixed ladder with org-defined meaning. See planning/risk-prioritization.md.
const ( CriticalityBC1 Criticality = "bc1" // failure causes outage or data loss CriticalityBC2 Criticality = "bc2" // degraded functionality, no immediate outage CriticalityBC3 Criticality = "bc3" // limited operational impact )
Criticality levels, from most to least critical.
func (Criticality) Valid ¶ added in v0.5.0
func (c Criticality) Valid() bool
Valid reports whether c is a known criticality level. The empty value (unclassified) is not valid here; callers decide how to treat unset criticality.
type Exposure ¶ added in v0.5.0
type Exposure string
Exposure is a component's risk-exposure level — how reachable it is to an attacker, and so how likely a weakness in it is to be hit. It is one axis of risk prioritization; higher exposure ranks a component's findings higher. The levels are a fixed ladder: an organization may redefine what each means, but not the count. Exposure may be proposed by a surveyor from topology and confirmed by a human. See planning/risk-prioritization.md.
const ( ExposureRE1 Exposure = "re1" // publicly exposed, no authentication ExposureRE2 Exposure = "re2" // publicly exposed behind authentication ExposureRE3 Exposure = "re3" // internal, broadly reachable ExposureRE4 Exposure = "re4" // restricted / narrowly scoped )
Exposure levels, from most to least exposed.
type Fragment ¶
type Fragment struct {
Components []Component `yaml:"components,omitempty"`
}
Fragment is a partial Saga contributed by a Surveyor (one of "the Ravens"). The engine merges fragments into the Model.
type Host ¶
type Host struct {
Name string `yaml:"name"`
URL string `yaml:"url"`
Type string `yaml:"type,omitempty"`
}
Host is a running endpoint. Type is "api" or "web".
type Image ¶
type Image struct {
Image string `yaml:"image"`
}
Image is a container image reference.
type Infrastructure ¶
Infrastructure is an infrastructure surface. Kind is e.g. "kubernetes"; Ref names the concrete instance.
type MetaSource ¶
type MetaSource struct {
RepoURL string `yaml:"repoUrl"`
Path string `yaml:"path"`
Revision string `yaml:"revision,omitempty"`
}
MetaSource points at a Saga fragment kept close to a component's source.
type Model ¶
type Model struct {
Release Release `yaml:"release"`
Config Config `yaml:"config,omitempty"`
Components []Component `yaml:"components,omitempty"`
ComponentsMetaSources []MetaSource `yaml:"componentsMetaSources,omitempty"`
References []Reference `yaml:"references,omitempty"`
}
Model is a parsed Saga descriptor — the declarative account of an application's security surface plus the controller configuration that drives a scan.
func Load ¶
Load parses a Saga descriptor from YAML bytes, substituting ${{ VAR }} references from the environment and validating the result.
type Reference ¶
Reference links a manual/human security control (e.g. threat model, architecture diagram).
type Release ¶
type Release struct {
Name string `yaml:"name"`
Version string `yaml:"version"`
Stage string `yaml:"stage,omitempty"`
}
Release identifies what is being assessed.
type Repository ¶
type Repository struct {
URL string `yaml:"url"`
Revision string `yaml:"revision,omitempty"`
Paths []string `yaml:"paths,omitempty"`
}
Repository is a source repository at a revision, optionally scoped to paths.
Source Files