sources

package
v0.45.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 16, 2026 License: Apache-2.0 Imports: 5 Imported by: 0

Documentation

Overview

Package sources holds the process-global factory registry used to instantiate SourcePlugin values from project configuration. Each in-tree source package registers itself via init(); the orchestrator (cmd/sigcomply/check.go) iterates cfg.Sources and looks up the factory by ID without knowing which sources exist.

This is the **only** seam a third party needs to add a custom source. Project-local plugins drop a package under .sigcomply/plugins/<id>/ whose init() calls sources.Register; `sigcomply build` (M16) compiles them in alongside the in-tree set. There is no runtime plugin loading, no shared library, no DSL — extensibility happens at build time, by code.

See docs/architecture/04-source-plugins.md §The plugin contract and docs/architecture/07-extensibility.md §Custom source plugins.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Build 

func Build(ctx context.Context, id string, env Env) (core.SourcePlugin, error)

Build looks up id and invokes the factory. It is the single entry point cmd/sigcomply uses; nothing in cmd needs to know which source IDs exist. Unknown IDs return a clear error pointing at the project-local plugin path.

func IDs 

func IDs() []string

IDs returns every registered ID in sorted order. The orchestrator uses this to produce a helpful error when a project config names a source ID that isn't compiled into the binary.

func RegisterFactory 

func RegisterFactory(id string, f Factory)

RegisterFactory adds a factory under id. Intended to be called from a source package's init(). Duplicate IDs panic at process start — duplicates among in-tree plugins are a programming error, and a project-local plugin claiming a reserved ID is a misconfiguration the build should not let through.

func StringOpt 

func StringOpt(m map[string]any, key string) string

StringOpt reads a string-valued entry from a YAML-unmarshaled map, returning "" when missing or the wrong type. Factories use it to pull values from Env.Config; the explicit two-step form avoids the `, _ := m[k].(string)` idiom (which our linter forbids under errcheck strict mode).

Types

type Env 

type Env struct {
	Config          map[string]any
	Vault           core.Vault
	FrameworkExtras map[string]any
}

Env carries everything a Factory needs to instantiate a plugin. The fields are stable contracts between the orchestrator and every registered factory; factories pull what they need and ignore the rest.

Config is the raw map from cfg.Sources[id] in the project YAML. Vault is the active core.Vault (some plugins, like manual.pdf, need it to fetch attachments). FrameworkExtras is an escape hatch for data that is framework-specific rather than project-specific (e.g., the manual catalog the active framework provides); a key/value convention is documented in each consuming source's package doc.

type Factory 

type Factory func(ctx context.Context, env Env) (core.SourcePlugin, error)

Factory builds a configured plugin instance. It is invoked once per registered source ID at the start of every `sigcomply check` run. Errors here surface as configuration errors (exit code 3).

func Lookup 

func Lookup(id string) (Factory, bool)

Lookup returns the factory registered under id, or (nil, false).

Source Files

View all Source files

Directories

Path Synopsis
aws
accesskeys
Package accesskeys implements the aws.iam_access_key source plugin: lists IAM users in one AWS account, then their programmatic access keys, and emits one iam_access_key evidence record per key — suitable for SOC 2 CC6 key-hygiene policies (rotation age, unused-key detection, never-used-active keys).
 Package accesskeys implements the aws.iam_access_key source plugin: lists IAM users in one AWS account, then their programmatic access keys, and emits one iam_access_key evidence record per key — suitable for SOC 2 CC6 key-hygiene policies (rotation age, unused-key detection, never-used-active keys).
acm
Package acm implements the aws.acm source plugin: lists ACM certificates and emits tls_certificate evidence records with cross-vendor expiry, managed-status, and auto-renewal attributes.
 Package acm implements the aws.acm source plugin: lists ACM certificates and emits tls_certificate evidence records with cross-vendor expiry, managed-status, and auto-renewal attributes.
backup
Package backup implements the aws.backup source plugin: lists AWS Backup plans and emits backup_plan evidence records with cross-vendor activeness and retention attributes.
 Package backup implements the aws.backup source plugin: lists AWS Backup plans and emits backup_plan evidence records with cross-vendor activeness and retention attributes.
cloudtrail
Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes.
 Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes.
cloudwatch
Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes.
 Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes.
config
Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits config_change_tracking evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
 Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits config_change_tracking evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
dynamodb
Package dynamodb implements the aws.dynamodb source plugin: lists DynamoDB tables and emits nosql_table evidence records with cross-vendor encryption, point-in-time-recovery, and deletion-protection attributes.
 Package dynamodb implements the aws.dynamodb source plugin: lists DynamoDB tables and emits nosql_table evidence records with cross-vendor encryption, point-in-time-recovery, and deletion-protection attributes.
ec2
Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes.
 Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes.
ecr
Package ecr implements the aws.ecr source plugin: lists ECR repositories in the private registry and emits container_registry evidence records with cross-vendor scan-on-push, public-exposure, immutability, and encryption attributes.
 Package ecr implements the aws.ecr source plugin: lists ECR repositories in the private registry and emits container_registry evidence records with cross-vendor scan-on-push, public-exposure, immutability, and encryption attributes.
eks
Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
 Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
guardduty
Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
 Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
iam
Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
 Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
inspector
Package inspector implements the aws.inspector source plugin: lists AWS Inspector2 findings and emits vulnerability_finding evidence records with cross-vendor severity, status, CVE, and remediation attributes.
 Package inspector implements the aws.inspector source plugin: lists AWS Inspector2 findings and emits vulnerability_finding evidence records with cross-vendor severity, status, CVE, and remediation attributes.
kms
Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
 Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
lambda
Package lambda implements the aws.lambda source plugin: lists AWS Lambda functions and emits serverless_function evidence records with cross-vendor VPC-placement, tracing, and environment-variable-encryption attributes.
 Package lambda implements the aws.lambda source plugin: lists AWS Lambda functions and emits serverless_function evidence records with cross-vendor VPC-placement, tracing, and environment-variable-encryption attributes.
passwordpolicy
Package passwordpolicy implements the aws.password_policy source plugin: reads the IAM account password policy and emits a single password_policy evidence record describing minimum length, expiry, reuse prevention, and the four character-class requirements.
 Package passwordpolicy implements the aws.password_policy source plugin: reads the IAM account password policy and emits a single password_policy evidence record describing minimum length, expiry, reuse prevention, and the four character-class requirements.
rds
Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes.
 Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes.
s3
Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores.
 Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores.
secretsmanager
Package secretsmanager implements the aws.secretsmanager source plugin: lists AWS Secrets Manager secrets and emits secret evidence records with cross-vendor rotation and encryption attributes.
 Package secretsmanager implements the aws.secretsmanager source plugin: lists AWS Secrets Manager secrets and emits secret evidence records with cross-vendor rotation and encryption attributes.
securityalert
Package securityalert implements the aws.security_alert source plugin.
 Package securityalert implements the aws.security_alert source plugin.
securitygroups
Package securitygroups implements the aws.security_group source plugin: lists EC2 security groups in one AWS account and emits one firewall_rule evidence record per ingress/egress rule, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate.
 Package securitygroups implements the aws.security_group source plugin: lists EC2 security groups in one AWS account and emits one firewall_rule evidence record per ingress/egress rule, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate.
securityservices
Package securityservices implements the aws.security_services source plugin: probes account-level enablement of AWS Macie, Inspector, and SecurityHub and emits one security_service evidence record per service.
 Package securityservices implements the aws.security_services source plugin: probes account-level enablement of AWS Macie, Inspector, and SecurityHub and emits one security_service evidence record per service.
vpc
Package vpc implements the aws.vpc source plugin: lists VPCs in one AWS account and emits network evidence records carrying the cross-vendor flow-logging / default-network attributes policies check.
 Package vpc implements the aws.vpc source plugin: lists VPCs in one AWS account and emits network evidence records carrying the cross-vendor flow-logging / default-network attributes policies check.
Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
 Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
gcp
asset
Package asset implements the gcp.asset source plugin: it emits a single config_change_tracking evidence record describing whether a GCP project has resource-change tracking configured — the same cloud-neutral type aws.config emits, so the config-recording policies (SOC2 CC7.1, ISO A.8.9) span both clouds with zero changes (Invariant #4, substitutability).
 Package asset implements the gcp.asset source plugin: it emits a single config_change_tracking evidence record describing whether a GCP project has resource-change tracking configured — the same cloud-neutral type aws.config emits, so the config-recording policies (SOC2 CC7.1, ISO A.8.9) span both clouds with zero changes (Invariant #4, substitutability).
audit
Package audit implements the gcp.audit source plugin: it emits a single audit_log_trail evidence record describing a GCP project's Cloud Audit Logs posture — the same cloud-neutral type aws.cloudtrail emits, so the audit-logging policies (SOC2 CC7.1, ISO A.8.15) span both clouds with zero changes (Invariant #4, substitutability).
 Package audit implements the gcp.audit source plugin: it emits a single audit_log_trail evidence record describing a GCP project's Cloud Audit Logs posture — the same cloud-neutral type aws.cloudtrail emits, so the audit-logging policies (SOC2 CC7.1, ISO A.8.15) span both clouds with zero changes (Invariant #4, substitutability).
compute
Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
 Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
directory
Package directory implements the gcp.directory source plugin: lists Google Workspace / Cloud Identity users via the Admin SDK Directory API and emits one cross-vendor directory_user record per user so MFA, admin, and lifecycle policies (e.g.
 Package directory implements the gcp.directory source plugin: lists Google Workspace / Cloud Identity users via the Admin SDK Directory API and emits one cross-vendor directory_user record per user so MFA, admin, and lifecycle policies (e.g.
firewall
Package firewall implements the gcp.firewall source plugin: lists VPC firewall rules in one GCP project and emits one firewall_rule evidence record per protocol/port-range within each firewall, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate — the same neutral type aws.security_group emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package firewall implements the gcp.firewall source plugin: lists VPC firewall rules in one GCP project and emits one firewall_rule evidence record per protocol/port-range within each firewall, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate — the same neutral type aws.security_group emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
iam
Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
 Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
kms
Package kms implements the gcp.kms source plugin: lists Cloud KMS crypto keys across every location in one GCP project and emits one kms_key evidence record per key, carrying the rotation and manager attributes key-rotation policies evaluate — the same neutral type aws.kms emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package kms implements the gcp.kms source plugin: lists Cloud KMS crypto keys across every location in one GCP project and emits one kms_key evidence record per key, carrying the rotation and manager attributes key-rotation policies evaluate — the same neutral type aws.kms emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
logging
Package logging implements the gcp.logging source plugin: lists Cloud Logging log buckets in one GCP project and emits one log_group evidence record per bucket, carrying the retention and encryption attributes the log-retention and log-encryption policies evaluate — the same cloud-neutral type aws.cloudwatch emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package logging implements the gcp.logging source plugin: lists Cloud Logging log buckets in one GCP project and emits one log_group evidence record per bucket, carrying the retention and encryption attributes the log-retention and log-encryption policies evaluate — the same cloud-neutral type aws.cloudwatch emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
network
Package network implements the gcp.network source plugin: lists VPC Networks in one GCP project and emits one network evidence record per VPC, carrying the cross-vendor flow-logging / default-network attributes policies evaluate — the same neutral type aws.vpc emits, so flow-log and default-VPC-removal policies span both clouds with zero changes (Invariant #4, substitutability).
 Package network implements the gcp.network source plugin: lists VPC Networks in one GCP project and emits one network evidence record per VPC, carrying the cross-vendor flow-logging / default-network attributes policies evaluate — the same neutral type aws.vpc emits, so flow-log and default-VPC-removal policies span both clouds with zero changes (Invariant #4, substitutability).
secretmanager
Package secretmanager implements the gcp.secretmanager source plugin: lists Secret Manager secrets in one GCP project and emits one secret evidence record per secret, carrying the rotation and encryption attributes the secrets-rotation and secrets-encryption policies evaluate — the same cloud-neutral type aws.secretsmanager emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package secretmanager implements the gcp.secretmanager source plugin: lists Secret Manager secrets in one GCP project and emits one secret evidence record per secret, carrying the rotation and encryption attributes the secrets-rotation and secrets-encryption policies evaluate — the same cloud-neutral type aws.secretsmanager emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
sql
Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
 Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
storage
Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
 Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
Package github implements the github source plugin: lists repositories and organization members from a single GitHub organization and emits two evidence types — github_repository and github_org_member — suitable for SOC 2 branch-protection and 2FA coverage policies.
 Package github implements the github source plugin: lists repositories and organization members from a single GitHub organization and emits two evidence types — github_repository and github_org_member — suitable for SOC 2 branch-protection and 2FA coverage policies.
Package gitlab implements the gitlab source plugin: lists projects ("repositories") and members under a single GitLab group and emits the cross-vendor git_repository and directory_user evidence types — suitable for SOC 2 / ISO 27001 branch-protection, code-review, and identity (MFA/admin/lifecycle) policies.
 Package gitlab implements the gitlab source plugin: lists projects ("repositories") and members under a single GitLab group and emits the cross-vendor git_repository and directory_user evidence types — suitable for SOC 2 / ISO 27001 branch-protection, code-review, and identity (MFA/admin/lifecycle) policies.
Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry.
 Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry.
azureblob
Package azureblob implements the manual.pdf Reader on Azure Blob Storage.
 Package azureblob implements the manual.pdf Reader on Azure Blob Storage.
builtin
Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry.
 Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry.
fileconv
Package fileconv converts common image formats to PDF bytes.
 Package fileconv converts common image formats to PDF bytes.
gcs
Package gcs implements the manual.pdf Reader on Google Cloud Storage.
 Package gcs implements the manual.pdf Reader on Google Cloud Storage.
pdfmerge
Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu.
 Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu.
s3
Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
 Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits two evidence types — okta_user and okta_app — suitable for SOC 2 MFA coverage policies.
 Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits two evidence types — okta_user and okta_app — suitable for SOC 2 MFA coverage policies.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.