securitybaseline

package

v0.42.0 Latest Latest Go to latest Published: Sep 24, 2026 License: Apache-2.0 Imports: 4 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/kombifyio/stackkits

Links

Open Source Insights

Documentation ¶

Overview ¶

Package securitybaseline renders the host security baseline script shared by legacy StackKit execution and architecture-v2 renderers.

Index ¶

Constants
func Build(cfg Config) (string, error)
func ContractHash(policy []byte) string
func NormalizePermitRootLogin(value string) string
func RenderV2HostPolicy() ([]byte, error)
type Config
type Mode

Constants ¶

View Source

const (
	EvidenceSchemaVersion               = "stackkit.security-baseline/v1"
	EvidenceModePublicBeta              = "public-beta"
	EvidenceSchemaVersionArchitectureV2 = "stackkit.security-baseline/v2"
	EvidenceModeArchitectureV2          = "architecture-v2-foundation"
)

Variables ¶

This section is empty.

Functions ¶

func Build ¶

func Build(cfg Config) (string, error)

Build renders a POSIX-sh compatible baseline script.

func ContractHash ¶

func ContractHash(policy []byte) string

ContractHash returns the canonical sha256-prefixed digest of an exact rendered policy. It can be stored directly alongside a render unit for drift detection.

func NormalizePermitRootLogin ¶

func NormalizePermitRootLogin(value string) string

NormalizePermitRootLogin returns a safe sshd value or an empty string when the input must be replaced with the secure default.

func RenderV2HostPolicy ¶

func RenderV2HostPolicy() ([]byte, error)

RenderV2HostPolicy renders the canonical, self-contained architecture-v2 host policy. Renderers should use this convenience instead of constructing a v2 Config so the policy and its package-manager safety prelude cannot drift.

Types ¶

type Config ¶

type Config struct {
	Mode                         Mode
	SSHPort                      int
	PermitRootLogin              string
	MaxAuthTries                 int
	PackageManagerLockWaitScript string
}

Config contains inputs for rendering a security-baseline script. SSH fields are authoritative only for legacy-v1 and are ignored by Architecture-v2.

type Mode ¶

type Mode string

Mode selects the governed policy generation. Legacy-v1 preserves the existing public-beta host rollout. Architecture-v2 deliberately contains only target-neutral controls; access, identity, firewall, and routing remain owned by typed product modules.

const (
	ModeLegacyV1       Mode = "legacy-v1"
	ModeArchitectureV2 Mode = "architecture-v2"
)

Source Files ¶

View all Source files

builder.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL