verify

package
v1.0.6 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 6, 2026 License: Apache-2.0 Imports: 25 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func CollectNamespacedObjects 

func CollectNamespacedObjects(ctx context.Context, client *kube.Client, namespace string) ([]map[string]any, error)

func DecodeK8SYAML 

func DecodeK8SYAML(manifest string) ([]map[string]any, error)

func DecodeK8SYAMLWithHelmSources 

func DecodeK8SYAMLWithHelmSources(manifest string) ([]map[string]any, error)

DecodeK8SYAMLWithHelmSources preserves Helm template source hints by parsing documents individually and extracting "# Source:" comments before decoding.

func DecodeK8SYAMLWithSources 

func DecodeK8SYAMLWithSources(manifest string) ([]map[string]any, error)

DecodeK8SYAMLWithSources decodes a multi-document YAML manifest into objects and attaches a best-effort template source (Helm "# Source: ...") to each object, if present.

It annotates objects with: - __torque_source: string

func EvaluatePolicy 

func EvaluatePolicy(ctx context.Context, opts PolicyOptions, objects []map[string]any) (*policy.Report, error)

func ManifestDigestSHA256 

func ManifestDigestSHA256(manifest string) string

func RenderFixPlanText 

func RenderFixPlanText(changes []FixChange) string

func RulesetDigest 

func RulesetDigest(dir string) (string, error)

func RulesetDigestMulti 

func RulesetDigestMulti(dirs []string) (string, error)

func SHA256Hex 

func SHA256Hex(text string) string

func SplitYAMLDocs 

func SplitYAMLDocs(manifest string) []string

SplitYAMLDocs splits a YAML stream into raw documents. It is intentionally simple and only treats "---" at the start of a line as a separator.

func ToSARIF 

func ToSARIF(rep *Report) ([]byte, error)

func WriteExposureJSON 

func WriteExposureJSON(w io.Writer, ex *ExposureReport) error

func WriteReport 

func WriteReport(w io.Writer, rep *Report, format OutputFormat) error

Types

type Console 

type Console struct {
	// contains filtered or unexported fields
}

Console renders verify events into a single in-place updating TTY view. It is event-driven: callers should feed Event values via Observe.

func NewConsole 

func NewConsole(out io.Writer, meta ConsoleMeta, opts ConsoleOptions) *Console

func (*Console) Done 

func (c *Console) Done()

func (*Console) Observe 

func (c *Console) Observe(ev Event)

func (*Console) SnapshotLines 

func (c *Console) SnapshotLines() []string

SnapshotLines returns the current console surface as plain lines (no cursor movement). It is intended for tests and debugging.

type ConsoleMeta 

type ConsoleMeta struct {
	Target     string
	Mode       Mode
	FailOn     Severity
	PolicyRef  string
	PolicyMode string
}

type ConsoleOptions 

type ConsoleOptions struct {
	Enabled bool
	Width   int
	Color   bool

	// Tail limits the number of recent findings shown (0 uses a default).
	Tail int

	// Now returns the current time for elapsed calculations. Defaults to time.Now.
	Now func() time.Time
}

type Delta 

type Delta struct {
	NewOrChanged []Finding
	Fixed        []Finding
	Unchanged    int

	NewOrChangedDetails []DeltaDetail
	FixedDetails        []DeltaDetail
}

func ComputeDelta 

func ComputeDelta(current *Report, baseline *Report) Delta

type DeltaDetail 

type DeltaDetail struct {
	Kind     string   `json:"kind,omitempty"` // new|changed|fixed
	Changes  []string `json:"changes,omitempty"`
	Current  *Finding `json:"current,omitempty"`
	Baseline *Finding `json:"baseline,omitempty"`
}

DeltaDetail describes why a finding is considered new/changed/fixed when comparing the current report against a baseline.

It is designed for UX consumers (HTML report, PR comments) to show a concise change narrative without having to re-derive it client-side.

type DeltaReport 

type DeltaReport struct {
	BaselineTotal int `json:"baselineTotal,omitempty"`
	Unchanged     int `json:"unchanged,omitempty"`

	// NewOrChanged and Fixed are kept for backwards compatibility with older
	// reports/consumers.
	NewOrChanged []Finding `json:"newOrChanged,omitempty"`
	Fixed        []Finding `json:"fixed,omitempty"`

	// NewOrChangedDetails and FixedDetails provide a change narrative for compare-to:
	// what changed (message/observed/expected/severity/etc) and a snapshot of the
	// baseline finding.
	NewOrChangedDetails []DeltaDetail `json:"newOrChangedDetails,omitempty"`
	FixedDetails        []DeltaDetail `json:"fixedDetails,omitempty"`
}

type Emitter 

type Emitter func(Event) error

type EngineMeta 

type EngineMeta struct {
	Name    string `json:"name"`
	Version string `json:"version,omitempty"`
	Ruleset string `json:"ruleset,omitempty"`
}

type Event 

type Event struct {
	Type       EventType
	When       time.Time
	Phase      string
	Counts     map[string]int
	Finding    *Finding
	Summary    *Summary
	Passed     bool
	Blocked    bool
	Target     string
	Ruleset    string
	PolicyRef  string
	PolicyMode string
}

type EventType 

type EventType string
const (
	EventReset    EventType = "reset"
	EventStarted  EventType = "started"
	EventProgress EventType = "progress"
	EventFinding  EventType = "finding"
	EventSummary  EventType = "summary"
	EventDone     EventType = "done"
)

type ExposureEdge 

type ExposureEdge struct {
	From string            `json:"from"`
	To   string            `json:"to"`
	Kind string            `json:"kind"` // ingress->service, service->pod, service->workload
	Meta map[string]string `json:"meta,omitempty"`
}

type ExposureGraph 

type ExposureGraph struct {
	Nodes []ExposureNode `json:"nodes,omitempty"`
	Edges []ExposureEdge `json:"edges,omitempty"`
}

type ExposureNode 

type ExposureNode struct {
	ID    string            `json:"id"`
	Kind  string            `json:"kind"`
	Name  string            `json:"name"`
	Meta  map[string]string `json:"meta,omitempty"`
	Score int               `json:"score,omitempty"`
}

type ExposureReport 

type ExposureReport struct {
	PublicSurfaces []PublicSurface `json:"publicSurfaces,omitempty"`
	Graph          ExposureGraph   `json:"graph,omitempty"`
}

func AnalyzeExposure 

func AnalyzeExposure(objects []map[string]any) ExposureReport

type Finding 

type Finding struct {
	RuleID      string         `json:"ruleId"`
	Severity    Severity       `json:"severity"`
	Category    string         `json:"category,omitempty"`
	Message     string         `json:"message"`
	FieldPath   string         `json:"fieldPath,omitempty"`
	Path        string         `json:"path,omitempty"`
	Line        int            `json:"line,omitempty"`
	Location    string         `json:"location,omitempty"`
	ResourceKey string         `json:"resourceKey,omitempty"`
	Expected    string         `json:"expected,omitempty"`
	Observed    string         `json:"observed,omitempty"`
	Subject     Subject        `json:"subject,omitempty"`
	Fingerprint string         `json:"fingerprint,omitempty"`
	HelpURL     string         `json:"helpUrl,omitempty"`
	Tags        []string       `json:"tags,omitempty"`
	Evidence    map[string]any `json:"evidence,omitempty"`
}

func AnnotateFindingsWithRenderedSource 

func AnnotateFindingsWithRenderedSource(renderedPath string, renderedManifest string, findings []Finding) []Finding

AnnotateFindingsWithRenderedSource sets Finding.Path and Finding.Line based on the rendered manifest's YAML node positions. It does not overwrite existing Path/Line values.

renderedPath should be a real file path when possible so SARIF consumers can open the artifact and jump to the line.

func EvaluateRules 

func EvaluateRules(ctx context.Context, rules Ruleset, objects []map[string]any, commonDirs []string) ([]Finding, error)

func EvaluateRulesWithSelectors 

func EvaluateRulesWithSelectors(ctx context.Context, rules Ruleset, objects []map[string]any, commonDirs []string, selectors SelectorSet, ruleSelectors []RuleSelector) ([]Finding, error)

func PolicyReportToFindings 

func PolicyReportToFindings(rep *policy.Report) []Finding

type FixChange 

type FixChange struct {
	Kind      string `json:"kind,omitempty"`
	Namespace string `json:"namespace,omitempty"`
	Name      string `json:"name,omitempty"`
	RuleID    string `json:"ruleId,omitempty"`
	Title     string `json:"title,omitempty"`
	PatchYAML string `json:"patchYaml,omitempty"`
}

func BuildFixPlan 

func BuildFixPlan(findings []Finding) []FixChange

type Input 

type Input struct {
	Kind            string `json:"kind,omitempty"` // chart|namespace|manifest
	Source          string `json:"source,omitempty"`
	Chart           string `json:"chart,omitempty"`
	Release         string `json:"release,omitempty"`
	Namespace       string `json:"namespace,omitempty"`
	RenderedSHA256  string `json:"renderedSha256,omitempty"`
	CollectedAtHint string `json:"collectedAtHint,omitempty"`
}

type Mode 

type Mode string
const (
	ModeWarn  Mode = "warn"
	ModeBlock Mode = "block"
	ModeOff   Mode = "off"
)

type Options 

type Options struct {
	Mode          Mode
	FailOn        Severity
	Format        OutputFormat
	RulesDir      string
	ExtraRules    []string
	Selectors     SelectorSet
	RuleSelectors []RuleSelector
	AttestDir     string
	ReportPath    string
	Now           func() time.Time
}

type OutputFormat 

type OutputFormat string
const (
	OutputTable OutputFormat = "table"
	OutputJSON  OutputFormat = "json"
	OutputSARIF OutputFormat = "sarif"
	OutputHTML  OutputFormat = "html"
	OutputMD    OutputFormat = "md"
)

type PolicyOptions 

type PolicyOptions struct {
	Ref  string
	Mode string // warn|enforce (mapped by caller)
	Now  func() time.Time
}

type PublicSurface 

type PublicSurface struct {
	ID        string            `json:"id"`
	Kind      string            `json:"kind"` // ingress|service
	Namespace string            `json:"namespace,omitempty"`
	Name      string            `json:"name"`
	Score     int               `json:"score"`
	Evidence  map[string]any    `json:"evidence,omitempty"`
	Targets   []TargetReference `json:"targets,omitempty"`
}

type Report 

type Report struct {
	Tool        string          `json:"tool"`
	Engine      EngineMeta      `json:"engine"`
	Mode        Mode            `json:"mode"`
	FailOn      Severity        `json:"failOn,omitempty"`
	Passed      bool            `json:"passed"`
	Blocked     bool            `json:"blocked"`
	EvaluatedAt time.Time       `json:"evaluatedAt"`
	Inputs      []Input         `json:"inputs,omitempty"`
	Summary     Summary         `json:"summary"`
	Findings    []Finding       `json:"findings,omitempty"`
	Delta       *DeltaReport    `json:"delta,omitempty"`
	Exposure    *ExposureReport `json:"exposure,omitempty"`
}

func LoadReport 

func LoadReport(path string) (*Report, error)

func VerifyObjects 

func VerifyObjects(ctx context.Context, objects []map[string]any, opts Options) (*Report, error)

func VerifyObjectsWithEmitter 

func VerifyObjectsWithEmitter(ctx context.Context, target string, objects []map[string]any, opts Options, emit Emitter) (*Report, error)

type Rule 

type Rule struct {
	ID          string
	Title       string
	Severity    Severity
	Category    string
	Description string
	HelpURL     string
	Dir         string
}

type RuleSelector 

type RuleSelector struct {
	Rule    string   `yaml:"rule,omitempty" json:"rule,omitempty"`
	Include Selector `yaml:"include,omitempty" json:"include,omitempty"`
	Exclude Selector `yaml:"exclude,omitempty" json:"exclude,omitempty"`
}

type Ruleset 

type Ruleset struct {
	Dir   string
	Rules []Rule
}

func LoadRuleset 

func LoadRuleset(dirs ...string) (Ruleset, error)

type Runner 

type Runner struct {
	RulesDir string
}

func (Runner) Verify 

func (r Runner) Verify(ctx context.Context, target string, objects []map[string]any, opts Options, emit Emitter) (*Report, error)

type Selector 

type Selector struct {
	Kinds      []string          `yaml:"kinds,omitempty" json:"kinds,omitempty"`
	Namespaces []string          `yaml:"namespaces,omitempty" json:"namespaces,omitempty"`
	Labels     map[string]string `yaml:"labels,omitempty" json:"labels,omitempty"`
	Regex      []string          `yaml:"regex,omitempty" json:"regex,omitempty"`
}

type SelectorSet 

type SelectorSet struct {
	Include Selector `yaml:"include,omitempty" json:"include,omitempty"`
	Exclude Selector `yaml:"exclude,omitempty" json:"exclude,omitempty"`
}

type Severity 

type Severity string
const (
	SeverityCritical Severity = "critical"
	SeverityHigh     Severity = "high"
	SeverityMedium   Severity = "medium"
	SeverityLow      Severity = "low"
	SeverityInfo     Severity = "info"
)

type Subject 

type Subject struct {
	Kind      string `json:"kind,omitempty"`
	Namespace string `json:"namespace,omitempty"`
	Name      string `json:"name,omitempty"`
}

type Summary 

type Summary struct {
	Total          int                         `json:"total"`
	BySev          map[Severity]int            `json:"bySeverity,omitempty"`
	ByRule         map[string]int              `json:"byRule,omitempty"`
	ByRuleSeverity map[string]map[Severity]int `json:"byRuleSeverity,omitempty"`
	Passed         bool                        `json:"passed"`
	Blocked        bool                        `json:"blocked"`
}

func BuildSummary 

func BuildSummary(findings []Finding, blocked bool) Summary

BuildSummary computes summary stats for findings.

type TargetReference 

type TargetReference struct {
	Kind      string `json:"kind"`
	Namespace string `json:"namespace,omitempty"`
	Name      string `json:"name"`
}

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.