sources

package
v0.71.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 18, 2026 License: Apache-2.0 Imports: 8 Imported by: 0

Documentation

Overview

Package sources holds the process-global factory registry used to instantiate SourcePlugin values from project configuration. Each in-tree source package registers itself via init(); the orchestrator (cmd/sigcomply/check.go) iterates cfg.Sources and looks up the factory by ID without knowing which sources exist.

This is the **only** seam a third party needs to add a custom source. Project-local plugins drop a package under .sigcomply/plugins/<id>/ whose init() calls sources.Register; `sigcomply build` (M16) compiles them in alongside the in-tree set. There is no runtime plugin loading, no shared library, no DSL — extensibility happens at build time, by code.

See docs/architecture/04-source-plugins.md §The plugin contract and docs/architecture/07-extensibility.md §Custom source plugins.

Index

Constants

This section is empty.

Variables

View Source 
var IDPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]*(\[[A-Za-z0-9._-]{1,64}\])?$`)

IDPattern is the grammar for a source key in `sources:`.

A key is a base plugin ID, optionally followed by a bracketed instance name: `aws.iam`, `aws.iam[backup]`. The instance name makes a second, independently-configured copy of the same plugin — a second AWS account, a second GitHub org.

The grammar is restrictive on purpose. A source key is not just a map key: it becomes part of an evidence envelope's object key in the vault (see collector.envelopePath). Letting `/` or `..` through would let a config write outside its own run folder, and only the local backend guards against that. Forbidding the characters outright is the cheaper and more obvious defense.

Uppercase is permitted because project-local plugins register whatever ID they like (see docs/architecture/07-extensibility.md) and we do not want the config loader to be stricter than the registry. ':' is excluded because the binding syntax already uses it to separate a source from a catalog entry (`manual.pdf:entry_id`).

Functions

func Build 

func Build(ctx context.Context, id string, env Env) (core.SourcePlugin, error)

Build looks up id and invokes the factory. It is the single entry point cmd/sigcomply uses; nothing in cmd needs to know which source IDs exist. Unknown IDs return a clear error pointing at the project-local plugin path.

func IDs 

func IDs() []string

IDs returns every registered ID in sorted order. The orchestrator uses this to produce a helpful error when a project config names a source ID that isn't compiled into the binary.

func RegisterFactory 

func RegisterFactory(id string, f Factory)

RegisterFactory adds a factory under id. Intended to be called from a source package's init(). Duplicate IDs panic at process start — duplicates among in-tree plugins are a programming error, and a project-local plugin claiming a reserved ID is a misconfiguration the build should not let through.

func ResolveToken added in v0.67.0 

func ResolveToken(cfg map[string]any, sourceID, configKey, fallbackEnv string) (string, error)

ResolveToken resolves an API token for one source instance, in precedence order: an explicit `token` in config, then the environment variable named by `token_env`, then the shared fallback variable.

`token_env` exists for multi-instance configs. The shared fallback (GITHUB_TOKEN, GITLAB_TOKEN, OKTA_API_TOKEN) is process-global, so two instances that both rely on it authenticate as the same principal and collect the same org twice under two different names — evidence that looks independent and is not. Naming a different variable per instance is what keeps their credentials distinct without putting secrets in a file that lives in git. 

sources:
  github:
    org: acme
  "github[labs]":
    org: acme-labs
    token_env: GITHUB_TOKEN_LABS

configKey/fallbackEnv name the plugin's own keys so the error message can list every way to supply the credential.

func SplitInstanceID added in v0.67.0 

func SplitInstanceID(key string) (base, instance string)

SplitInstanceID splits a source key into its base plugin ID and its instance name. `aws.iam[backup]` → ("aws.iam", "backup"); a plain `aws.iam` → ("aws.iam", ""). Assumes a key that already satisfies IDPattern; anything else is returned unchanged as the base.

func StringOpt 

func StringOpt(m map[string]any, key string) string

StringOpt reads a string-valued entry from a YAML-unmarshaled map, returning "" when missing or the wrong type. Factories use it to pull values from Env.Config; the explicit two-step form avoids the `, _ := m[k].(string)` idiom (which our linter forbids under errcheck strict mode).

func ValidID added in v0.67.0 

func ValidID(id string) bool

ValidID reports whether id is a well-formed source key.

Types

type Env 

type Env struct {
	Config          map[string]any
	Vault           core.Vault
	FrameworkExtras map[string]any
}

Env carries everything a Factory needs to instantiate a plugin. The fields are stable contracts between the orchestrator and every registered factory; factories pull what they need and ignore the rest.

Config is the raw map from cfg.Sources[id] in the project YAML. Vault is the active core.Vault (some plugins, like manual.pdf, need it to fetch attachments). FrameworkExtras is an escape hatch for data that is framework-specific rather than project-specific (e.g., the manual catalog the active framework provides); a key/value convention is documented in each consuming source's package doc.

type Factory 

type Factory func(ctx context.Context, env Env) (core.SourcePlugin, error)

Factory builds a configured plugin instance. It is invoked once per registered source ID at the start of every `sigcomply check` run. Errors here surface as configuration errors (exit code 3).

func Lookup 

func Lookup(id string) (Factory, bool)

Lookup returns the factory registered under id, or (nil, false).

Source Files

View all Source files

Directories

Path Synopsis
Package activedirectory implements the active_directory source plugin: it reads user objects from an on-premises Active Directory domain over LDAPS (or LDAP + StartTLS) and emits one roster_entry per user, so a project can designate AD as its workforce roster.
 Package activedirectory implements the active_directory source plugin: it reads user objects from an on-premises Active Directory domain over LDAPS (or LDAP + StartTLS) and emits one roster_entry per user, so a project can designate AD as its workforce roster.
aws
accesskeys
Package accesskeys implements the aws.iam_access_key source plugin: lists IAM users in one AWS account, then their programmatic access keys, and emits one iam_access_key evidence record per key — suitable for SOC 2 CC6 key-hygiene policies (rotation age, unused-key detection, never-used-active keys).
 Package accesskeys implements the aws.iam_access_key source plugin: lists IAM users in one AWS account, then their programmatic access keys, and emits one iam_access_key evidence record per key — suitable for SOC 2 CC6 key-hygiene policies (rotation age, unused-key detection, never-used-active keys).
acm
Package acm implements the aws.acm source plugin: lists ACM certificates and emits tls_certificate evidence records with cross-vendor expiry, managed-status, and auto-renewal attributes.
 Package acm implements the aws.acm source plugin: lists ACM certificates and emits tls_certificate evidence records with cross-vendor expiry, managed-status, and auto-renewal attributes.
awscfg
Package awscfg builds the AWS SDK config for one configured source instance.
 Package awscfg builds the AWS SDK config for one configured source instance.
awstest
Package awstest is the AWS test seam (WU-2.1): it builds an aws.Config whose HTTP traffic is recorded/replayed through a go-vcr cassette, so AWS source plugins can be exercised offline through the real SDK deserializer.
 Package awstest is the AWS test seam (WU-2.1): it builds an aws.Config whose HTTP traffic is recorded/replayed through a go-vcr cassette, so AWS source plugins can be exercised offline through the real SDK deserializer.
backup
Package backup implements the aws.backup source plugin: lists AWS Backup plans and emits backup_plan evidence records with cross-vendor activeness and retention attributes.
 Package backup implements the aws.backup source plugin: lists AWS Backup plans and emits backup_plan evidence records with cross-vendor activeness and retention attributes.
cloudtrail
Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes.
 Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes.
cloudwatch
Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes.
 Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes.
config
Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits config_change_tracking evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
 Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits config_change_tracking evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
dynamodb
Package dynamodb implements the aws.dynamodb source plugin: lists DynamoDB tables and emits nosql_table evidence records with cross-vendor encryption, point-in-time-recovery, and deletion-protection attributes.
 Package dynamodb implements the aws.dynamodb source plugin: lists DynamoDB tables and emits nosql_table evidence records with cross-vendor encryption, point-in-time-recovery, and deletion-protection attributes.
ec2
Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes.
 Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes.
ecr
Package ecr implements the aws.ecr source plugin: lists ECR repositories in the private registry and emits container_registry evidence records with cross-vendor scan-on-push, public-exposure, immutability, and encryption attributes.
 Package ecr implements the aws.ecr source plugin: lists ECR repositories in the private registry and emits container_registry evidence records with cross-vendor scan-on-push, public-exposure, immutability, and encryption attributes.
eks
Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
 Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
guardduty
Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
 Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
iam
Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
 Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
inspector
Package inspector implements the aws.inspector source plugin: lists AWS Inspector2 findings and emits vulnerability_finding evidence records with cross-vendor severity, status, CVE, and remediation attributes.
 Package inspector implements the aws.inspector source plugin: lists AWS Inspector2 findings and emits vulnerability_finding evidence records with cross-vendor severity, status, CVE, and remediation attributes.
kms
Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
 Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
lambda
Package lambda implements the aws.lambda source plugin: lists AWS Lambda functions and emits serverless_function evidence records with cross-vendor VPC-placement, tracing, and environment-variable-encryption attributes.
 Package lambda implements the aws.lambda source plugin: lists AWS Lambda functions and emits serverless_function evidence records with cross-vendor VPC-placement, tracing, and environment-variable-encryption attributes.
passwordpolicy
Package passwordpolicy implements the aws.password_policy source plugin: reads the IAM account password policy and emits a single password_policy evidence record describing minimum length, expiry, reuse prevention, and the four character-class requirements.
 Package passwordpolicy implements the aws.password_policy source plugin: reads the IAM account password policy and emits a single password_policy evidence record describing minimum length, expiry, reuse prevention, and the four character-class requirements.
rds
Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes.
 Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes.
s3
Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores.
 Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores.
secretsmanager
Package secretsmanager implements the aws.secretsmanager source plugin: lists AWS Secrets Manager secrets and emits secret evidence records with cross-vendor rotation and encryption attributes.
 Package secretsmanager implements the aws.secretsmanager source plugin: lists AWS Secrets Manager secrets and emits secret evidence records with cross-vendor rotation and encryption attributes.
securityalert
Package securityalert implements the aws.security_alert source plugin.
 Package securityalert implements the aws.security_alert source plugin.
securitygroups
Package securitygroups implements the aws.security_group source plugin: lists EC2 security groups in one AWS account and emits one firewall_rule evidence record per ingress/egress rule, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate.
 Package securitygroups implements the aws.security_group source plugin: lists EC2 security groups in one AWS account and emits one firewall_rule evidence record per ingress/egress rule, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate.
securityservices
Package securityservices implements the aws.security_services source plugin: probes account-level enablement of AWS Macie, Inspector, and SecurityHub and emits one security_service evidence record per service.
 Package securityservices implements the aws.security_services source plugin: probes account-level enablement of AWS Macie, Inspector, and SecurityHub and emits one security_service evidence record per service.
vpc
Package vpc implements the aws.vpc source plugin: lists VPCs in one AWS account and emits network evidence records carrying the cross-vendor flow-logging / default-network attributes policies check.
 Package vpc implements the aws.vpc source plugin: lists VPCs in one AWS account and emits network evidence records carrying the cross-vendor flow-logging / default-network attributes policies check.
azure
acr
Package acr implements the azure.acr source plugin: it lists Azure Container Registries in a subscription and emits one cross-vendor container_registry record per registry, so scan-on-push, public-exposure, and encryption policies evaluate against Azure exactly as they do against AWS ECR and GCP Artifact Registry — zero policy changes (Invariant #4).
 Package acr implements the azure.acr source plugin: it lists Azure Container Registries in a subscription and emits one cross-vendor container_registry record per registry, so scan-on-push, public-exposure, and encryption policies evaluate against Azure exactly as they do against AWS ECR and GCP Artifact Registry — zero policy changes (Invariant #4).
aks
Package aks implements the azure.aks source plugin: it lists Azure Kubernetes Service (AKS) managed clusters in a subscription and emits one cross-vendor kubernetes_cluster record per cluster, so secrets-encryption, logging, and network-isolation policies evaluate against Azure exactly as they do against AWS EKS and GCP GKE — zero policy changes (Invariant #4).
 Package aks implements the azure.aks source plugin: it lists Azure Kubernetes Service (AKS) managed clusters in a subscription and emits one cross-vendor kubernetes_cluster record per cluster, so secrets-encryption, logging, and network-isolation policies evaluate against Azure exactly as they do against AWS EKS and GCP GKE — zero policy changes (Invariant #4).
backup
Package backup implements the azure.backup source plugin: it enumerates Azure Recovery Services backup protection policies across a subscription and emits one cross-vendor backup_plan record per policy, so the backup_plan policy (soc2.a1.1.backup_plan_exists) evaluates against Azure exactly as it does against AWS Backup and GCP Backup — zero policy changes (Invariant #4).
 Package backup implements the azure.backup source plugin: it enumerates Azure Recovery Services backup protection policies across a subscription and emits one cross-vendor backup_plan record per policy, so the backup_plan policy (soc2.a1.1.backup_plan_exists) evaluates against Azure exactly as it does against AWS Backup and GCP Backup — zero policy changes (Invariant #4).
certs
Package certs implements the azure.certs source plugin: it lists Azure certificates in a subscription and emits one cross-vendor tls_certificate record per certificate, so the expiry and auto-renewal policies evaluate against Azure exactly as they do against AWS ACM and GCP Certificate Manager — zero policy changes (Invariant #4, substitutability).
 Package certs implements the azure.certs source plugin: it lists Azure certificates in a subscription and emits one cross-vendor tls_certificate record per certificate, so the expiry and auto-renewal policies evaluate against Azure exactly as they do against AWS ACM and GCP Certificate Manager — zero policy changes (Invariant #4, substitutability).
compute
Package compute implements the azure.compute source plugin: it lists Azure Virtual Machines in a subscription and emits one cross-vendor compute_instance record per VM, so network-exposure, encryption, and monitoring policies evaluate against Azure exactly as they do against AWS EC2 and GCP Compute Engine — zero policy changes (Invariant #4).
 Package compute implements the azure.compute source plugin: it lists Azure Virtual Machines in a subscription and emits one cross-vendor compute_instance record per VM, so network-exposure, encryption, and monitoring policies evaluate against Azure exactly as they do against AWS EC2 and GCP Compute Engine — zero policy changes (Invariant #4).
cosmos
Package cosmos implements the azure.cosmos source plugin: it lists Azure Cosmos DB accounts in a subscription and emits one cross-vendor nosql_table record per account, so the encryption, point-in-time-recovery, and deletion-protection policies evaluate against Azure exactly as they do against AWS DynamoDB and GCP Firestore — zero policy changes (Invariant #4).
 Package cosmos implements the azure.cosmos source plugin: it lists Azure Cosmos DB accounts in a subscription and emits one cross-vendor nosql_table record per account, so the encryption, point-in-time-recovery, and deletion-protection policies evaluate against Azure exactly as they do against AWS DynamoDB and GCP Firestore — zero policy changes (Invariant #4).
defender
Package defender implements the azure.defender source plugin: it reads Microsoft Defender for Cloud (Azure Security Center) in a subscription and emits three cross-vendor types — threat_detection_service (one per Defender plan), security_service (one CSPM record for Defender for Cloud itself), and vulnerability_finding (one per security sub-assessment) — so threat-detection, security-service-enablement, and unaddressed-finding policies evaluate against Azure exactly as they do against AWS (GuardDuty / SecurityHub-Macie-Inspector / Inspector findings) and GCP (Security Command Center) — zero policy changes (Invariant #4).
 Package defender implements the azure.defender source plugin: it reads Microsoft Defender for Cloud (Azure Security Center) in a subscription and emits three cross-vendor types — threat_detection_service (one per Defender plan), security_service (one CSPM record for Defender for Cloud itself), and vulnerability_finding (one per security sub-assessment) — so threat-detection, security-service-enablement, and unaddressed-finding policies evaluate against Azure exactly as they do against AWS (GuardDuty / SecurityHub-Macie-Inspector / Inspector findings) and GCP (Security Command Center) — zero policy changes (Invariant #4).
entra
Package entra implements the azure.entra source plugin: lists Microsoft Entra ID (Azure AD) users via Microsoft Graph and emits one cross-vendor directory_user record per user, so MFA, admin, and lifecycle policies (e.g.
 Package entra implements the azure.entra source plugin: lists Microsoft Entra ID (Azure AD) users via Microsoft Graph and emits one cross-vendor directory_user record per user, so MFA, admin, and lifecycle policies (e.g.
internal/azcommon
Package azcommon is the shared credential, subscription, and resource-graph foundation reused by every azure.* source plugin (WU-5.0).
 Package azcommon is the shared credential, subscription, and resource-graph foundation reused by every azure.* source plugin (WU-5.0).
internal/azuretest
Package azuretest is the Azure ARM test seam (WU-2.12): it builds the arm.ClientOptions (transport + endpoint) and a fake credential that point an Azure SDK ARM client at a go-vcr cassette instead of the live management plane, so Azure source plugins run offline through the real deserializer.
 Package azuretest is the Azure ARM test seam (WU-2.12): it builds the arm.ClientOptions (transport + endpoint) and a fake credential that point an Azure SDK ARM client at a go-vcr cassette instead of the live management plane, so Azure source plugins run offline through the real deserializer.
keyvault
Package keyvault implements the azure.keyvault source plugin: it reads Azure Key Vault keys and secrets in a subscription and emits two cross-vendor types — kms_key (one per key — same type as aws.kms / gcp.kms) and secret (one per secret — same type as aws.secretsmanager / gcp.secretmanager) — so the key rotation, customer-managed-key, and secret rotation/encryption policies evaluate against Azure exactly as they do against AWS and GCP, with zero policy changes (Invariant #4).
 Package keyvault implements the azure.keyvault source plugin: it reads Azure Key Vault keys and secrets in a subscription and emits two cross-vendor types — kms_key (one per key — same type as aws.kms / gcp.kms) and secret (one per secret — same type as aws.secretsmanager / gcp.secretmanager) — so the key rotation, customer-managed-key, and secret rotation/encryption policies evaluate against Azure exactly as they do against AWS and GCP, with zero policy changes (Invariant #4).
monitor
Package monitor implements the azure.monitor source plugin: it reads Azure Monitor's logging surface in a subscription and emits two cross-vendor types — log_group (one per Log Analytics workspace) and audit_log_trail (one per subscription, the Activity Log) — so log-retention and audit-logging policies evaluate against Azure exactly as they do against AWS (CloudWatch Logs + CloudTrail) and GCP (log buckets + Cloud Audit Logs) — zero policy changes (Invariant #4).
 Package monitor implements the azure.monitor source plugin: it reads Azure Monitor's logging surface in a subscription and emits two cross-vendor types — log_group (one per Log Analytics workspace) and audit_log_trail (one per subscription, the Activity Log) — so log-retention and audit-logging policies evaluate against Azure exactly as they do against AWS (CloudWatch Logs + CloudTrail) and GCP (log buckets + Cloud Audit Logs) — zero policy changes (Invariant #4).
network
Package network implements the azure.network source plugin: it reads Azure Network Security Groups and Virtual Networks in a subscription and emits two cross-vendor types — firewall_rule (one per NSG rule, flattened) and network (one per VNet) — so network-exposure and flow-logging policies evaluate against Azure exactly as they do against AWS (security groups + VPCs) and GCP (firewall rules + VPC networks) — zero policy changes (Invariant #4).
 Package network implements the azure.network source plugin: it reads Azure Network Security Groups and Virtual Networks in a subscription and emits two cross-vendor types — firewall_rule (one per NSG rule, flattened) and network (one per VNet) — so network-exposure and flow-logging policies evaluate against Azure exactly as they do against AWS (security groups + VPCs) and GCP (firewall rules + VPC networks) — zero policy changes (Invariant #4).
policy
Package policy implements the azure.policy source plugin: it emits a single config_change_tracking evidence record describing whether an Azure subscription has resource-configuration tracking configured — the same cloud-neutral type aws.config and gcp.asset emit, so the config-recording policies (SOC2 CC7.1, ISO A.8.9) span all three clouds with zero policy changes (Invariant #4, substitutability).
 Package policy implements the azure.policy source plugin: it emits a single config_change_tracking evidence record describing whether an Azure subscription has resource-configuration tracking configured — the same cloud-neutral type aws.config and gcp.asset emit, so the config-recording policies (SOC2 CC7.1, ISO A.8.9) span all three clouds with zero policy changes (Invariant #4, substitutability).
sql
Package sql implements the azure.sql source plugin: it enumerates Azure's three managed relational-database services in a subscription and emits one cross-vendor managed_database_instance record per database/server, so encryption-at-rest, public-access, backup, SSL, and multi-AZ policies evaluate against Azure exactly as they do against AWS RDS and GCP Cloud SQL — zero policy changes (Invariant #4, substitutability).
 Package sql implements the azure.sql source plugin: it enumerates Azure's three managed relational-database services in a subscription and emits one cross-vendor managed_database_instance record per database/server, so encryption-at-rest, public-access, backup, SSL, and multi-AZ policies evaluate against Azure exactly as they do against AWS RDS and GCP Cloud SQL — zero policy changes (Invariant #4, substitutability).
storage
Package storage implements the azure.storage source plugin: lists every Azure Storage account in a subscription and emits one cross-vendor object_storage_bucket record per account, so encryption-at-rest, public-access, and versioning policies evaluate against Azure exactly as they do against AWS S3 and GCS — zero policy changes (Invariant #4, substitutability).
 Package storage implements the azure.storage source plugin: lists every Azure Storage account in a subscription and emits one cross-vendor object_storage_bucket record per account, so encryption-at-rest, public-access, and versioning policies evaluate against Azure exactly as they do against AWS S3 and GCS — zero policy changes (Invariant #4, substitutability).
Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
 Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
gcp
artifactregistry
Package artifactregistry implements the gcp.artifactregistry source plugin: lists Artifact Registry repositories across every location in one GCP project and emits one container_registry evidence record per repository, carrying the scan-on-push, public-exposure, immutability, and encryption attributes the container-registry policies evaluate — the same cloud-neutral type aws.ecr emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package artifactregistry implements the gcp.artifactregistry source plugin: lists Artifact Registry repositories across every location in one GCP project and emits one container_registry evidence record per repository, carrying the scan-on-push, public-exposure, immutability, and encryption attributes the container-registry policies evaluate — the same cloud-neutral type aws.ecr emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
asset
Package asset implements the gcp.asset source plugin: it emits a single config_change_tracking evidence record describing whether a GCP project has resource-change tracking configured — the same cloud-neutral type aws.config emits, so the config-recording policies (SOC2 CC7.1, ISO A.8.9) span both clouds with zero changes (Invariant #4, substitutability).
 Package asset implements the gcp.asset source plugin: it emits a single config_change_tracking evidence record describing whether a GCP project has resource-change tracking configured — the same cloud-neutral type aws.config emits, so the config-recording policies (SOC2 CC7.1, ISO A.8.9) span both clouds with zero changes (Invariant #4, substitutability).
audit
Package audit implements the gcp.audit source plugin: it emits a single audit_log_trail evidence record describing a GCP project's Cloud Audit Logs posture — the same cloud-neutral type aws.cloudtrail emits, so the audit-logging policies (SOC2 CC7.1, ISO A.8.15) span both clouds with zero changes (Invariant #4, substitutability).
 Package audit implements the gcp.audit source plugin: it emits a single audit_log_trail evidence record describing a GCP project's Cloud Audit Logs posture — the same cloud-neutral type aws.cloudtrail emits, so the audit-logging policies (SOC2 CC7.1, ISO A.8.15) span both clouds with zero changes (Invariant #4, substitutability).
backup
Package backup implements the gcp.backup source plugin: lists Backup and DR Service backup plans across every location in one GCP project and emits one backup_plan evidence record per plan, carrying the active / retention attributes the backup_plan policies evaluate — the same cloud-neutral type aws.backup emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package backup implements the gcp.backup source plugin: lists Backup and DR Service backup plans across every location in one GCP project and emits one backup_plan evidence record per plan, carrying the active / retention attributes the backup_plan policies evaluate — the same cloud-neutral type aws.backup emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
certs
Package certs implements the gcp.certs source plugin: lists Certificate Manager certificates across every location in one GCP project and emits one tls_certificate evidence record per certificate, carrying the expiry, managed-status, and auto-renewal attributes the tls_certificate policies evaluate — the same cloud-neutral type aws.acm emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package certs implements the gcp.certs source plugin: lists Certificate Manager certificates across every location in one GCP project and emits one tls_certificate evidence record per certificate, carrying the expiry, managed-status, and auto-renewal attributes the tls_certificate policies evaluate — the same cloud-neutral type aws.acm emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
compute
Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
 Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
directory
Package directory implements the gcp.directory source plugin: lists Google Workspace / Cloud Identity users via the Admin SDK Directory API and emits one cross-vendor directory_user record per user so MFA, admin, and lifecycle policies (e.g.
 Package directory implements the gcp.directory source plugin: lists Google Workspace / Cloud Identity users via the Admin SDK Directory API and emits one cross-vendor directory_user record per user so MFA, admin, and lifecycle policies (e.g.
firestore
Package firestore implements the gcp.firestore source plugin: lists Cloud Firestore databases in one GCP project and emits one nosql_table evidence record per database, carrying the encryption, point-in-time- recovery, and deletion-protection attributes the nosql_table policies evaluate — the same cloud-neutral type aws.dynamodb emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package firestore implements the gcp.firestore source plugin: lists Cloud Firestore databases in one GCP project and emits one nosql_table evidence record per database, carrying the encryption, point-in-time- recovery, and deletion-protection attributes the nosql_table policies evaluate — the same cloud-neutral type aws.dynamodb emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
firewall
Package firewall implements the gcp.firewall source plugin: lists VPC firewall rules in one GCP project and emits one firewall_rule evidence record per protocol/port-range within each firewall, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate — the same neutral type aws.security_group emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package firewall implements the gcp.firewall source plugin: lists VPC firewall rules in one GCP project and emits one firewall_rule evidence record per protocol/port-range within each firewall, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate — the same neutral type aws.security_group emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
gcptest
Package gcptest is the GCP test seam (WU-2.7): it builds the option.ClientOption set that points a GCP SDK client (google.golang.org/api/* or cloud.google.com/go/storage) at a go-vcr cassette instead of the live API, so GCP source plugins can be exercised offline through the real deserializer.
 Package gcptest is the GCP test seam (WU-2.7): it builds the option.ClientOption set that points a GCP SDK client (google.golang.org/api/* or cloud.google.com/go/storage) at a go-vcr cassette instead of the live API, so GCP source plugins can be exercised offline through the real deserializer.
gke
Package gke implements the gcp.gke source plugin: lists GKE (Google Kubernetes Engine) clusters across every location in one GCP project and emits one kubernetes_cluster evidence record per cluster, carrying the secrets-encryption, logging, and network-isolation attributes the kubernetes_cluster policies evaluate — the same cloud-neutral type aws.eks emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package gke implements the gcp.gke source plugin: lists GKE (Google Kubernetes Engine) clusters across every location in one GCP project and emits one kubernetes_cluster evidence record per cluster, carrying the secrets-encryption, logging, and network-isolation attributes the kubernetes_cluster policies evaluate — the same cloud-neutral type aws.eks emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
iam
Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
 Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
kms
Package kms implements the gcp.kms source plugin: lists Cloud KMS crypto keys across every location in one GCP project and emits one kms_key evidence record per key, carrying the rotation and manager attributes key-rotation policies evaluate — the same neutral type aws.kms emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package kms implements the gcp.kms source plugin: lists Cloud KMS crypto keys across every location in one GCP project and emits one kms_key evidence record per key, carrying the rotation and manager attributes key-rotation policies evaluate — the same neutral type aws.kms emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
logging
Package logging implements the gcp.logging source plugin: lists Cloud Logging log buckets in one GCP project and emits one log_group evidence record per bucket, carrying the retention and encryption attributes the log-retention and log-encryption policies evaluate — the same cloud-neutral type aws.cloudwatch emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package logging implements the gcp.logging source plugin: lists Cloud Logging log buckets in one GCP project and emits one log_group evidence record per bucket, carrying the retention and encryption attributes the log-retention and log-encryption policies evaluate — the same cloud-neutral type aws.cloudwatch emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
network
Package network implements the gcp.network source plugin: lists VPC Networks in one GCP project and emits one network evidence record per VPC, carrying the cross-vendor flow-logging / default-network attributes policies evaluate — the same neutral type aws.vpc emits, so flow-log and default-VPC-removal policies span both clouds with zero changes (Invariant #4, substitutability).
 Package network implements the gcp.network source plugin: lists VPC Networks in one GCP project and emits one network evidence record per VPC, carrying the cross-vendor flow-logging / default-network attributes policies evaluate — the same neutral type aws.vpc emits, so flow-log and default-VPC-removal policies span both clouds with zero changes (Invariant #4, substitutability).
scc
Package scc implements the gcp.scc source plugin: it reads Google Security Command Center (SCC) and emits three cross-vendor evidence types so SCC-backed GCP customers satisfy the same controls as AWS customers with zero policy changes (Invariant #4, substitutability):
 Package scc implements the gcp.scc source plugin: it reads Google Security Command Center (SCC) and emits three cross-vendor evidence types so SCC-backed GCP customers satisfy the same controls as AWS customers with zero policy changes (Invariant #4, substitutability):
secretmanager
Package secretmanager implements the gcp.secretmanager source plugin: lists Secret Manager secrets in one GCP project and emits one secret evidence record per secret, carrying the rotation and encryption attributes the secrets-rotation and secrets-encryption policies evaluate — the same cloud-neutral type aws.secretsmanager emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package secretmanager implements the gcp.secretmanager source plugin: lists Secret Manager secrets in one GCP project and emits one secret evidence record per secret, carrying the rotation and encryption attributes the secrets-rotation and secrets-encryption policies evaluate — the same cloud-neutral type aws.secretsmanager emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
sql
Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
 Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
storage
Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
 Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
Package github implements the github source plugin: it reads a single GitHub organization and emits six cloud-neutral evidence types — git_repository, directory_user, source_control_org_policy, vulnerability_finding, pull_request and deployment — suitable for SOC 2 branch-protection, 2FA-coverage and change-management policies.
 Package github implements the github source plugin: it reads a single GitHub organization and emits six cloud-neutral evidence types — git_repository, directory_user, source_control_org_policy, vulnerability_finding, pull_request and deployment — suitable for SOC 2 branch-protection, 2FA-coverage and change-management policies.
Package gitlab implements the gitlab source plugin: lists projects ("repositories") and members under a single GitLab group and emits the cross-vendor git_repository and directory_user evidence types — suitable for SOC 2 / ISO 27001 branch-protection, code-review, and identity (MFA/admin/lifecycle) policies.
 Package gitlab implements the gitlab source plugin: lists projects ("repositories") and members under a single GitLab group and emits the cross-vendor git_repository and directory_user evidence types — suitable for SOC 2 / ISO 27001 branch-protection, code-review, and identity (MFA/admin/lifecycle) policies.
Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry.
 Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry.
azureblob
Package azureblob implements the manual.pdf Reader on Azure Blob Storage.
 Package azureblob implements the manual.pdf Reader on Azure Blob Storage.
builtin
Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry.
 Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry.
fileconv
Package fileconv converts common image formats to PDF bytes.
 Package fileconv converts common image formats to PDF bytes.
gcs
Package gcs implements the manual.pdf Reader on Google Cloud Storage.
 Package gcs implements the manual.pdf Reader on Google Cloud Storage.
pdfmerge
Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu.
 Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu.
s3
Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
 Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits three evidence types — directory_user and okta_app (SOC 2 MFA coverage policies) and roster_entry (Okta as the organization's authoritative workforce roster, including deprovisioned users).
 Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits three evidence types — directory_user and okta_app (SOC 2 MFA coverage policies) and roster_entry (Okta as the organization's authoritative workforce roster, including deprovisioned users).
Package sourcetest is the shared test harness every source plugin's tests run through, so adding a plugin never means re-inventing test scaffolding.
 Package sourcetest is the shared test harness every source plugin's tests run through, so adding a plugin never means re-inventing test scaffolding.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.