Documentation
¶
Overview ¶
Package catalog is bumper's embedded advisory corpus: ~2,600 security best-practice records harvested from four Apache-2.0 sources (Trivy/tfsec, Checkov, KICS, Prowler), normalized to a common envelope.
It is deliberately FEDERATED, not merged — each source is its own map, with no dedup across sources. A query spreads across all four maps in parallel and the ranked hits are merged on the way out. This keeps every source independent: a source refresh touches only its own files, and the same intent legitimately appears from several sources (Trivy's severity, Prowler's fix code, etc.), which an agent reconciles.
This is the ADVISORY corpus (knowledge only — no executable predicate). It is distinct from internal/rules (the enforced rules that actually fire on a plan). IaC misconfig data is stable over months, so it ships embedded for fully offline search; the hosted Advisor is for the daily-churn CVE/container domain.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var Sources = []string{"prowler", "trivy", "kics", "checkov"}
Sources is the fixed set of corpora, in default priority order (severity + real fix code first; coverage filler last).
Functions ¶
This section is empty.
Types ¶
type Catalog ¶
type Catalog struct {
// contains filtered or unexported fields
}
Catalog holds the advisory corpus, one slice per source (the four maps).
type Entry ¶
type Entry struct {
Source string `json:"source"`
SourceID string `json:"source_id"`
Provider string `json:"provider"`
Resources []string `json:"resources"`
Severity string `json:"severity"`
Title string `json:"title"`
Remediation string `json:"remediation"`
FixTerraform string `json:"fix_terraform,omitempty"`
Refs []string `json:"refs"`
CWE string `json:"cwe"`
Category string `json:"category"`
}
Entry is one normalized advisory record. Severity may be "" (Checkov OSS ships none); FixTerraform is populated only by Prowler.
Source Files