verify

package
v1.0.9 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 24, 2026 License: Apache-2.0 Imports: 29 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func CollectNamespacedObjects 

func CollectNamespacedObjects(ctx context.Context, client *kube.Client, namespace string) ([]map[string]any, error)

func DecodeK8SYAML 

func DecodeK8SYAML(manifest string) ([]map[string]any, error)

func DecodeK8SYAMLWithHelmSources 

func DecodeK8SYAMLWithHelmSources(manifest string) ([]map[string]any, error)

DecodeK8SYAMLWithHelmSources preserves Helm template source hints by parsing documents individually and extracting "# Source:" comments before decoding.

func DecodeK8SYAMLWithSources 

func DecodeK8SYAMLWithSources(manifest string) ([]map[string]any, error)

DecodeK8SYAMLWithSources decodes a multi-document YAML manifest into objects and attaches a best-effort template source (Helm "# Source: ...") to each object, if present.

It annotates objects with: - __torque_source: string

func EvaluatePolicy 

func EvaluatePolicy(ctx context.Context, opts PolicyOptions, objects []map[string]any) (*policy.Report, error)

func ManifestDigestSHA256 

func ManifestDigestSHA256(manifest string) string

func RenderFixPlanText 

func RenderFixPlanText(changes []FixChange) string

func RenderSecretScanText added in v1.0.7 

func RenderSecretScanText(w io.Writer, report *SecretScanReport)

func RulesetDigest 

func RulesetDigest(dir string) (string, error)

func RulesetDigestMulti 

func RulesetDigestMulti(dirs []string) (string, error)

func SHA256Hex 

func SHA256Hex(text string) string

func SplitYAMLDocs 

func SplitYAMLDocs(manifest string) []string

SplitYAMLDocs splits a YAML stream into raw documents. It is intentionally simple and only treats "---" at the start of a line as a separator.

func ToSARIF 

func ToSARIF(rep *Report) ([]byte, error)

func WriteExposureJSON 

func WriteExposureJSON(w io.Writer, ex *ExposureReport) error

func WriteReport 

func WriteReport(w io.Writer, rep *Report, format OutputFormat) error

func WriteSecretScanReport added in v1.0.7 

func WriteSecretScanReport(w io.Writer, report *SecretScanReport) error

Types

type Console 

type Console struct {
	// contains filtered or unexported fields
}

Console renders verify events into a single in-place updating TTY view. It is event-driven: callers should feed Event values via Observe.

func NewConsole 

func NewConsole(out io.Writer, meta ConsoleMeta, opts ConsoleOptions) *Console

func (*Console) Done 

func (c *Console) Done()

func (*Console) Observe 

func (c *Console) Observe(ev Event)

func (*Console) SnapshotLines 

func (c *Console) SnapshotLines() []string

SnapshotLines returns the current console surface as plain lines (no cursor movement). It is intended for tests and debugging.

type ConsoleMeta 

type ConsoleMeta struct {
	Target     string
	Mode       Mode
	FailOn     Severity
	PolicyRef  string
	PolicyMode string
}

type ConsoleOptions 

type ConsoleOptions struct {
	Enabled bool
	Width   int
	Color   bool

	// Tail limits the number of recent findings shown (0 uses a default).
	Tail int

	// Now returns the current time for elapsed calculations. Defaults to time.Now.
	Now func() time.Time
}

type Delta 

type Delta struct {
	NewOrChanged []Finding
	Fixed        []Finding
	Unchanged    int

	NewOrChangedDetails []DeltaDetail
	FixedDetails        []DeltaDetail
}

func ComputeDelta 

func ComputeDelta(current *Report, baseline *Report) Delta

type DeltaDetail 

type DeltaDetail struct {
	Kind     string   `json:"kind,omitempty"` // new|changed|fixed
	Changes  []string `json:"changes,omitempty"`
	Current  *Finding `json:"current,omitempty"`
	Baseline *Finding `json:"baseline,omitempty"`
}

DeltaDetail describes why a finding is considered new/changed/fixed when comparing the current report against a baseline.

It is designed for UX consumers (HTML report, PR comments) to show a concise change narrative without having to re-derive it client-side.

type DeltaReport 

type DeltaReport struct {
	BaselineTotal int `json:"baselineTotal,omitempty"`
	Unchanged     int `json:"unchanged,omitempty"`

	// NewOrChanged and Fixed are kept for backwards compatibility with older
	// reports/consumers.
	NewOrChanged []Finding `json:"newOrChanged,omitempty"`
	Fixed        []Finding `json:"fixed,omitempty"`

	// NewOrChangedDetails and FixedDetails provide a change narrative for compare-to:
	// what changed (message/observed/expected/severity/etc) and a snapshot of the
	// baseline finding.
	NewOrChangedDetails []DeltaDetail `json:"newOrChangedDetails,omitempty"`
	FixedDetails        []DeltaDetail `json:"fixedDetails,omitempty"`
}

type Emitter 

type Emitter func(Event) error

type EngineMeta 

type EngineMeta struct {
	Name    string `json:"name"`
	Version string `json:"version,omitempty"`
	Ruleset string `json:"ruleset,omitempty"`
}

type Event 

type Event struct {
	Type       EventType
	When       time.Time
	Phase      string
	Counts     map[string]int
	Finding    *Finding
	Summary    *Summary
	Passed     bool
	Blocked    bool
	Target     string
	Ruleset    string
	PolicyRef  string
	PolicyMode string
}

type EventType 

type EventType string
const (
	EventReset    EventType = "reset"
	EventStarted  EventType = "started"
	EventProgress EventType = "progress"
	EventFinding  EventType = "finding"
	EventSummary  EventType = "summary"
	EventDone     EventType = "done"
)

type ExposureEdge 

type ExposureEdge struct {
	From string            `json:"from"`
	To   string            `json:"to"`
	Kind string            `json:"kind"` // ingress->service, service->pod, service->workload
	Meta map[string]string `json:"meta,omitempty"`
}

type ExposureGraph 

type ExposureGraph struct {
	Nodes []ExposureNode `json:"nodes,omitempty"`
	Edges []ExposureEdge `json:"edges,omitempty"`
}

type ExposureNode 

type ExposureNode struct {
	ID    string            `json:"id"`
	Kind  string            `json:"kind"`
	Name  string            `json:"name"`
	Meta  map[string]string `json:"meta,omitempty"`
	Score int               `json:"score,omitempty"`
}

type ExposureReport 

type ExposureReport struct {
	PublicSurfaces []PublicSurface `json:"publicSurfaces,omitempty"`
	Graph          ExposureGraph   `json:"graph,omitempty"`
}

func AnalyzeExposure 

func AnalyzeExposure(objects []map[string]any) ExposureReport

type Finding 

type Finding struct {
	RuleID      string         `json:"ruleId"`
	Severity    Severity       `json:"severity"`
	Category    string         `json:"category,omitempty"`
	Confidence  float64        `json:"confidence,omitempty"`
	Message     string         `json:"message"`
	FieldPath   string         `json:"fieldPath,omitempty"`
	Path        string         `json:"path,omitempty"`
	Line        int            `json:"line,omitempty"`
	Location    string         `json:"location,omitempty"`
	ResourceKey string         `json:"resourceKey,omitempty"`
	Expected    string         `json:"expected,omitempty"`
	Observed    string         `json:"observed,omitempty"`
	Subject     Subject        `json:"subject,omitempty"`
	Fingerprint string         `json:"fingerprint,omitempty"`
	HelpURL     string         `json:"helpUrl,omitempty"`
	Tags        []string       `json:"tags,omitempty"`
	Evidence    map[string]any `json:"evidence,omitempty"`
	Fix         *FindingFix    `json:"fix,omitempty"`
}

func AnnotateFindingsWithRenderedSource 

func AnnotateFindingsWithRenderedSource(renderedPath string, renderedManifest string, findings []Finding) []Finding

AnnotateFindingsWithRenderedSource sets Finding.Path and Finding.Line based on the rendered manifest's YAML node positions. It does not overwrite existing Path/Line values.

renderedPath should be a real file path when possible so SARIF consumers can open the artifact and jump to the line.

func EvaluateRules 

func EvaluateRules(ctx context.Context, rules Ruleset, objects []map[string]any, commonDirs []string) ([]Finding, error)

func EvaluateRulesWithSelectors 

func EvaluateRulesWithSelectors(ctx context.Context, rules Ruleset, objects []map[string]any, commonDirs []string, selectors SelectorSet, ruleSelectors []RuleSelector) ([]Finding, error)

func PolicyReportToFindings 

func PolicyReportToFindings(rep *policy.Report) []Finding

type FindingFix added in v1.0.7 

type FindingFix struct {
	Summary   string `json:"summary,omitempty"`
	PatchHint string `json:"patchHint,omitempty"`
}

type FixChange 

type FixChange struct {
	Kind      string `json:"kind,omitempty"`
	Namespace string `json:"namespace,omitempty"`
	Name      string `json:"name,omitempty"`
	RuleID    string `json:"ruleId,omitempty"`
	Title     string `json:"title,omitempty"`
	PatchYAML string `json:"patchYaml,omitempty"`
}

func BuildFixPlan 

func BuildFixPlan(findings []Finding) []FixChange

type Input 

type Input struct {
	Kind            string `json:"kind,omitempty"` // chart|namespace|manifest
	Source          string `json:"source,omitempty"`
	Chart           string `json:"chart,omitempty"`
	Release         string `json:"release,omitempty"`
	Namespace       string `json:"namespace,omitempty"`
	RenderedSHA256  string `json:"renderedSha256,omitempty"`
	CollectedAtHint string `json:"collectedAtHint,omitempty"`
}

type Mode 

type Mode string
const (
	ModeWarn  Mode = "warn"
	ModeBlock Mode = "block"
	ModeOff   Mode = "off"
)

type Options 

type Options struct {
	Mode          Mode
	FailOn        Severity
	Format        OutputFormat
	RulesDir      string
	ExtraRules    []string
	Selectors     SelectorSet
	RuleSelectors []RuleSelector
	AttestDir     string
	ReportPath    string
	Now           func() time.Time
}

type OutputFormat 

type OutputFormat string
const (
	OutputTable OutputFormat = "table"
	OutputJSON  OutputFormat = "json"
	OutputSARIF OutputFormat = "sarif"
	OutputHTML  OutputFormat = "html"
	OutputMD    OutputFormat = "md"
)

type PolicyOptions 

type PolicyOptions struct {
	Ref  string
	Mode string // warn|enforce (mapped by caller)
	Now  func() time.Time
}

type PublicSurface 

type PublicSurface struct {
	ID        string            `json:"id"`
	Kind      string            `json:"kind"` // ingress|service
	Namespace string            `json:"namespace,omitempty"`
	Name      string            `json:"name"`
	Score     int               `json:"score"`
	Evidence  map[string]any    `json:"evidence,omitempty"`
	Targets   []TargetReference `json:"targets,omitempty"`
}

type RedactionProof added in v1.0.7 

type RedactionProof struct {
	Surfaces     []RedactionSurfaceProof `json:"surfaces,omitempty"`
	FailedClosed bool                    `json:"failedClosed"`
}

type RedactionRuleMatch added in v1.0.7 

type RedactionRuleMatch struct {
	RuleID string `json:"ruleId"`
	Count  int    `json:"count"`
}

type RedactionSurfaceProof added in v1.0.7 

type RedactionSurfaceProof struct {
	Surface         string               `json:"surface"`
	Matches         []RedactionRuleMatch `json:"matches,omitempty"`
	RawSecretStored bool                 `json:"rawSecretStored"`
}

type Report 

type Report struct {
	Tool        string          `json:"tool"`
	Engine      EngineMeta      `json:"engine"`
	Mode        Mode            `json:"mode"`
	FailOn      Severity        `json:"failOn,omitempty"`
	Passed      bool            `json:"passed"`
	Blocked     bool            `json:"blocked"`
	EvaluatedAt time.Time       `json:"evaluatedAt"`
	Inputs      []Input         `json:"inputs,omitempty"`
	Summary     Summary         `json:"summary"`
	Findings    []Finding       `json:"findings,omitempty"`
	Delta       *DeltaReport    `json:"delta,omitempty"`
	Exposure    *ExposureReport `json:"exposure,omitempty"`
}

func LoadReport 

func LoadReport(path string) (*Report, error)

func VerifyObjects 

func VerifyObjects(ctx context.Context, objects []map[string]any, opts Options) (*Report, error)

func VerifyObjectsWithEmitter 

func VerifyObjectsWithEmitter(ctx context.Context, target string, objects []map[string]any, opts Options, emit Emitter) (*Report, error)

type Rule 

type Rule struct {
	ID          string
	Title       string
	Severity    Severity
	Category    string
	Description string
	HelpURL     string
	Dir         string
}

type RuleSelector 

type RuleSelector struct {
	Rule    string   `yaml:"rule,omitempty" json:"rule,omitempty"`
	Include Selector `yaml:"include,omitempty" json:"include,omitempty"`
	Exclude Selector `yaml:"exclude,omitempty" json:"exclude,omitempty"`
}

type Ruleset 

type Ruleset struct {
	Dir   string
	Rules []Rule
}

func LoadRuleset 

func LoadRuleset(dirs ...string) (Ruleset, error)

type Runner 

type Runner struct {
	RulesDir string
}

func (Runner) Verify 

func (r Runner) Verify(ctx context.Context, target string, objects []map[string]any, opts Options, emit Emitter) (*Report, error)

type SecretFlowEdge added in v1.0.7 

type SecretFlowEdge struct {
	ID       string `json:"id"`
	From     string `json:"from"`
	To       string `json:"to"`
	Kind     string `json:"kind"`
	Boundary string `json:"boundary,omitempty"`
	RuleID   string `json:"ruleId,omitempty"`
	Redacted bool   `json:"redacted"`
}

type SecretFlowGraph added in v1.0.7 

type SecretFlowGraph struct {
	Version     string                 `json:"version"`
	GeneratedAt time.Time              `json:"generatedAt"`
	Source      string                 `json:"source,omitempty"`
	Profile     string                 `json:"profile,omitempty"`
	Summary     SecretFlowGraphSummary `json:"summary"`
	Nodes       []SecretFlowNode       `json:"nodes,omitempty"`
	Edges       []SecretFlowEdge       `json:"edges,omitempty"`
}

type SecretFlowGraphSummary added in v1.0.7 

type SecretFlowGraphSummary struct {
	Nodes                   int  `json:"nodes"`
	Edges                   int  `json:"edges"`
	ProvenanceChains        int  `json:"provenanceChains"`
	ValuesSources           int  `json:"valuesSources"`
	TemplateSources         int  `json:"templateSources"`
	RenderedObjects         int  `json:"renderedObjects"`
	LiveObjects             int  `json:"liveObjects"`
	ForbiddenFlows          int  `json:"forbiddenFlows"`
	AllowedMaterializations int  `json:"allowedMaterializations"`
	SecretReferences        int  `json:"secretReferences"`
	RedactedOutputs         int  `json:"redactedOutputs"`
	RawSecretStored         bool `json:"rawSecretStored"`
}

type SecretFlowNode added in v1.0.7 

type SecretFlowNode struct {
	ID           string  `json:"id"`
	Kind         string  `json:"kind"`
	Stage        string  `json:"stage,omitempty"`
	Surface      string  `json:"surface,omitempty"`
	Boundary     string  `json:"boundary,omitempty"`
	ResourceKey  string  `json:"resourceKey,omitempty"`
	ResourceKind string  `json:"resourceKind,omitempty"`
	FieldPath    string  `json:"fieldPath,omitempty"`
	Path         string  `json:"path,omitempty"`
	Line         int     `json:"line,omitempty"`
	Digest       string  `json:"digest,omitempty"`
	Subject      Subject `json:"subject,omitempty"`
	RuleID       string  `json:"ruleId,omitempty"`
	ValuePreview string  `json:"valuePreview,omitempty"`
	RawStored    bool    `json:"rawStored"`
}

type SecretScanOptions added in v1.0.7 

type SecretScanOptions struct {
	Mode           Mode
	FailOn         Severity
	Profile        string
	Source         string
	Stage          string
	Surface        string
	BoundaryMatrix bool
	FlowGraph      bool
	TargetKind     string
	ValuesFiles    []string
	RenderedPath   string
	RenderedSource string
	EvaluatedAt    time.Time
}

type SecretScanReport added in v1.0.7 

type SecretScanReport struct {
	Version        string                  `json:"version"`
	Tool           string                  `json:"tool"`
	Mode           Mode                    `json:"mode"`
	FailOn         Severity                `json:"failOn,omitempty"`
	Profile        string                  `json:"profile,omitempty"`
	Passed         bool                    `json:"passed"`
	Blocked        bool                    `json:"blocked"`
	EvaluatedAt    time.Time               `json:"evaluatedAt"`
	Source         string                  `json:"source,omitempty"`
	Summary        SecretScanSummary       `json:"summary"`
	Findings       []Finding               `json:"findings,omitempty"`
	BoundaryMatrix *SecurityBoundaryMatrix `json:"boundaryMatrix,omitempty"`
	FlowGraph      *SecretFlowGraph        `json:"flowGraph,omitempty"`
	RedactionProof RedactionProof          `json:"redactionProof"`
}

func ScanRenderedSecrets added in v1.0.7 

func ScanRenderedSecrets(objects []map[string]any, opts SecretScanOptions) (*SecretScanReport, error)

func ScanTextSecrets added in v1.0.7 

func ScanTextSecrets(inputs []SecretTextInput, opts SecretScanOptions) (*SecretScanReport, error)

type SecretScanSummary added in v1.0.7 

type SecretScanSummary struct {
	Total                   int              `json:"total"`
	BySeverity              map[Severity]int `json:"bySeverity,omitempty"`
	SecretReferences        int              `json:"secretReferences"`
	AllowedMaterializations int              `json:"allowedMaterializations"`
	RedactedMatches         int              `json:"redactedMatches"`
	RawSecretStored         bool             `json:"rawSecretStored"`
}

type SecretTextInput added in v1.0.7 

type SecretTextInput struct {
	Path    string
	Content string
	Stage   string
}

type SecurityBoundaryMatrix added in v1.0.7 

type SecurityBoundaryMatrix struct {
	Version     string                        `json:"version"`
	Profile     string                        `json:"profile,omitempty"`
	Source      string                        `json:"source,omitempty"`
	GeneratedAt time.Time                     `json:"generatedAt"`
	Passed      bool                          `json:"passed"`
	Summary     SecurityBoundaryMatrixSummary `json:"summary"`
	Rows        []SecurityBoundaryMatrixRow   `json:"rows"`
}

func BuildSecurityBoundaryMatrix added in v1.0.7 

func BuildSecurityBoundaryMatrix(objects []map[string]any, report *SecretScanReport, opts SecretScanOptions) *SecurityBoundaryMatrix

type SecurityBoundaryMatrixRow added in v1.0.7 

type SecurityBoundaryMatrixRow struct {
	Surface                 string         `json:"surface"`
	Boundary                string         `json:"boundary"`
	Status                  string         `json:"status"`
	Passed                  bool           `json:"passed"`
	Present                 bool           `json:"present"`
	ExpectedResourceKinds   []string       `json:"expectedResourceKinds,omitempty"`
	ResourceKinds           []string       `json:"resourceKinds,omitempty"`
	Resources               []string       `json:"resources,omitempty"`
	FieldPaths              []string       `json:"fieldPaths,omitempty"`
	FindingCount            int            `json:"findingCount"`
	AllowedMaterializations int            `json:"allowedMaterializations,omitempty"`
	ReferenceCount          int            `json:"referenceCount,omitempty"`
	Evidence                map[string]any `json:"evidence,omitempty"`
}

type SecurityBoundaryMatrixSummary added in v1.0.7 

type SecurityBoundaryMatrixSummary struct {
	Total                   int `json:"total"`
	Present                 int `json:"present"`
	Passed                  int `json:"passed"`
	Failed                  int `json:"failed"`
	BlockedFindings         int `json:"blockedFindings"`
	AllowedMaterializations int `json:"allowedMaterializations"`
	References              int `json:"references"`
}

type Selector 

type Selector struct {
	Kinds      []string          `yaml:"kinds,omitempty" json:"kinds,omitempty"`
	Namespaces []string          `yaml:"namespaces,omitempty" json:"namespaces,omitempty"`
	Labels     map[string]string `yaml:"labels,omitempty" json:"labels,omitempty"`
	Regex      []string          `yaml:"regex,omitempty" json:"regex,omitempty"`
}

type SelectorSet 

type SelectorSet struct {
	Include Selector `yaml:"include,omitempty" json:"include,omitempty"`
	Exclude Selector `yaml:"exclude,omitempty" json:"exclude,omitempty"`
}

type Severity 

type Severity string
const (
	SeverityCritical Severity = "critical"
	SeverityHigh     Severity = "high"
	SeverityMedium   Severity = "medium"
	SeverityLow      Severity = "low"
	SeverityInfo     Severity = "info"
)

type Subject 

type Subject struct {
	Kind      string `json:"kind,omitempty"`
	Namespace string `json:"namespace,omitempty"`
	Name      string `json:"name,omitempty"`
}

type Summary 

type Summary struct {
	Total          int                         `json:"total"`
	BySev          map[Severity]int            `json:"bySeverity,omitempty"`
	ByRule         map[string]int              `json:"byRule,omitempty"`
	ByRuleSeverity map[string]map[Severity]int `json:"byRuleSeverity,omitempty"`
	Passed         bool                        `json:"passed"`
	Blocked        bool                        `json:"blocked"`
}

func BuildSummary 

func BuildSummary(findings []Finding, blocked bool) Summary

BuildSummary computes summary stats for findings.

type TargetReference 

type TargetReference struct {
	Kind      string `json:"kind"`
	Namespace string `json:"namespace,omitempty"`
	Name      string `json:"name"`
}

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.