sources

package
v0.28.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 2, 2026 License: Apache-2.0 Imports: 5 Imported by: 0

Documentation

Overview

Package sources holds the process-global factory registry used to instantiate SourcePlugin values from project configuration. Each in-tree source package registers itself via init(); the orchestrator (cmd/sigcomply/check.go) iterates cfg.Sources and looks up the factory by ID without knowing which sources exist.

This is the **only** seam a third party needs to add a custom source. Project-local plugins drop a package under .sigcomply/plugins/<id>/ whose init() calls sources.Register; `sigcomply build` (M16) compiles them in alongside the in-tree set. There is no runtime plugin loading, no shared library, no DSL — extensibility happens at build time, by code.

See docs/architecture/04-source-plugins.md §The plugin contract and docs/architecture/07-extensibility.md §Custom source plugins.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Build 

func Build(ctx context.Context, id string, env Env) (core.SourcePlugin, error)

Build looks up id and invokes the factory. It is the single entry point cmd/sigcomply uses; nothing in cmd needs to know which source IDs exist. Unknown IDs return a clear error pointing at the project-local plugin path.

func IDs 

func IDs() []string

IDs returns every registered ID in sorted order. The orchestrator uses this to produce a helpful error when a project config names a source ID that isn't compiled into the binary.

func RegisterFactory 

func RegisterFactory(id string, f Factory)

RegisterFactory adds a factory under id. Intended to be called from a source package's init(). Duplicate IDs panic at process start — duplicates among in-tree plugins are a programming error, and a project-local plugin claiming a reserved ID is a misconfiguration the build should not let through.

func StringOpt 

func StringOpt(m map[string]any, key string) string

StringOpt reads a string-valued entry from a YAML-unmarshaled map, returning "" when missing or the wrong type. Factories use it to pull values from Env.Config; the explicit two-step form avoids the `, _ := m[k].(string)` idiom (which our linter forbids under errcheck strict mode).

Types

type Env 

type Env struct {
	Config          map[string]any
	Vault           core.Vault
	FrameworkExtras map[string]any
}

Env carries everything a Factory needs to instantiate a plugin. The fields are stable contracts between the orchestrator and every registered factory; factories pull what they need and ignore the rest.

Config is the raw map from cfg.Sources[id] in the project YAML. Vault is the active core.Vault (some plugins, like manual.pdf, need it to fetch attachments). FrameworkExtras is an escape hatch for data that is framework-specific rather than project-specific (e.g., the manual catalog the active framework provides); a key/value convention is documented in each consuming source's package doc.

type Factory 

type Factory func(ctx context.Context, env Env) (core.SourcePlugin, error)

Factory builds a configured plugin instance. It is invoked once per registered source ID at the start of every `sigcomply check` run. Errors here surface as configuration errors (exit code 3).

func Lookup 

func Lookup(id string) (Factory, bool)

Lookup returns the factory registered under id, or (nil, false).

Source Files

View all Source files

Directories

Path Synopsis
aws
cloudtrail
Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes.
 Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes.
cloudwatch
Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes.
 Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes.
config
Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits configuration_recorder evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
 Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits configuration_recorder evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
ec2
Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes.
 Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes.
eks
Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
 Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
guardduty
Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
 Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
iam
Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
 Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
kms
Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
 Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
rds
Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes.
 Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes.
s3
Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores.
 Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores.
Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
 Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
gcp
compute
Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
 Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
iam
Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
 Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
sql
Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
 Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
storage
Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
 Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
Package github implements the github source plugin: lists repositories and organization members from a single GitHub organization and emits two evidence types — github_repository and github_org_member — suitable for SOC 2 branch-protection and 2FA coverage policies.
 Package github implements the github source plugin: lists repositories and organization members from a single GitHub organization and emits two evidence types — github_repository and github_org_member — suitable for SOC 2 branch-protection and 2FA coverage policies.
Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry.
 Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry.
azureblob
Package azureblob implements the manual.pdf Reader on Azure Blob Storage.
 Package azureblob implements the manual.pdf Reader on Azure Blob Storage.
builtin
Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry.
 Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry.
fileconv
Package fileconv converts common image formats to PDF bytes.
 Package fileconv converts common image formats to PDF bytes.
gcs
Package gcs implements the manual.pdf Reader on Google Cloud Storage.
 Package gcs implements the manual.pdf Reader on Google Cloud Storage.
pdfmerge
Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu.
 Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu.
s3
Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
 Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits two evidence types — okta_user and okta_app — suitable for SOC 2 MFA coverage policies.
 Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits two evidence types — okta_user and okta_app — suitable for SOC 2 MFA coverage policies.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.