Directories
¶
| Path | Synopsis |
|---|---|
|
Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []core.PolicyResult into the structurally counts-only core.SubmissionPayload that the cloud submitter consumes.
|
Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []core.PolicyResult into the structurally counts-only core.SubmissionPayload that the cloud submitter consumes. |
|
Package collector is L4 of the SigComply CLI.
|
Package collector is L4 of the SigComply CLI. |
|
Package core is L1 of the SigComply CLI: the frozen Go interfaces and structs that every higher layer depends on.
|
Package core is L1 of the SigComply CLI: the frozen Go interfaces and structs that every higher layer depends on. |
|
Package evaluator is L5 of the SigComply CLI: runs each policy's rule against the records collected for it and emits a PolicyResult.
|
Package evaluator is L5 of the SigComply CLI: runs each policy's rule against the records collected for it and emits a PolicyResult. |
|
Package evidencetypes holds the in-tree evidence-type schemas (JSON Schema documents) and exposes the loader that registers them into the orchestrator's EvidenceType registry at bootstrap.
|
Package evidencetypes holds the in-tree evidence-type schemas (JSON Schema documents) and exposes the loader that registers them into the orchestrator's EvidenceType registry at bootstrap. |
|
Package frameworks holds the process-global registry of compliance framework factories.
|
Package frameworks holds the process-global registry of compliance framework factories. |
|
builtin
Package builtin imports every in-tree framework for the side effect of running its init() — which registers a Factory with the frameworks registry.
|
Package builtin imports every in-tree framework for the side effect of running its init() — which registers a Factory with the frameworks registry. |
|
iso27001
Package iso27001 is the ISO/IEC 27001:2022 framework: the Annex A control catalog, the automated technological-control policies in the pass_when: DSL, and the manual-evidence policies across the organizational, people, physical, and technological themes.
|
Package iso27001 is the ISO/IEC 27001:2022 framework: the Annex A control catalog, the automated technological-control policies in the pass_when: DSL, and the manual-evidence policies across the organizational, people, physical, and technological themes. |
|
soc2
Package soc2 is the SOC 2 (TSC 2017) framework: the control catalog, the automated policy library expressed in the pass_when: DSL, and the manual-evidence policies.
|
Package soc2 is the SOC 2 (TSC 2017) framework: the control catalog, the automated policy library expressed in the pass_when: DSL, and the manual-evidence policies. |
|
Package log is the cross-cutting redaction logger.
|
Package log is the cross-cutting redaction logger. |
|
Package manualcatalog defines the descriptive, presentation-facing manual-evidence catalog that `sigcomply evidence catalog` exports as JSON.
|
Package manualcatalog defines the descriptive, presentation-facing manual-evidence catalog that `sigcomply evidence catalog` exports as JSON. |
|
Package orchestrator is L9 of the SigComply CLI: wires L3 through L8 for the `sigcomply check` command — config load, registry init, plan, collect, evaluate, persist, aggregate, submit, render.
|
Package orchestrator is L9 of the SigComply CLI: wires L3 through L8 for the `sigcomply check` command — config load, registry init, plan, collect, evaluate, persist, aggregate, submit, render. |
|
Package planner is L3 of the SigComply CLI: reads the project config plus the selected framework plus the registries and produces a fully resolved RunPlan — slot bindings, effective parameters, resolved exceptions, derived period.
|
Package planner is L3 of the SigComply CLI: reads the project config plus the selected framework plus the registries and produces a fully resolved RunPlan — slot bindings, effective parameters, resolved exceptions, derived period. |
|
Package registry is L2 of the SigComply CLI: in-process catalogs of the things that can be referenced by ID — frameworks, source plugins, rules, evidence types, and policies.
|
Package registry is L2 of the SigComply CLI: in-process catalogs of the things that can be referenced by ID — frameworks, source plugins, rules, evidence types, and policies. |
|
Package report implements `sigcomply report`: the read-only, auditor-facing snapshot tool.
|
Package report implements `sigcomply report`: the read-only, auditor-facing snapshot tool. |
|
Package sign is the cross-cutting signing primitive: per-file ephemeral Ed25519 keypair generation, canonical JSON encoding (RFC 8785-style), and envelope signing/verification.
|
Package sign is the cross-cutting signing primitive: per-file ephemeral Ed25519 keypair generation, canonical JSON encoding (RFC 8785-style), and envelope signing/verification. |
|
Package sources holds the process-global factory registry used to instantiate SourcePlugin values from project configuration.
|
Package sources holds the process-global factory registry used to instantiate SourcePlugin values from project configuration. |
|
aws/accesskeys
Package accesskeys implements the aws.iam_access_key source plugin: lists IAM users in one AWS account, then their programmatic access keys, and emits one iam_access_key evidence record per key — suitable for SOC 2 CC6 key-hygiene policies (rotation age, unused-key detection, never-used-active keys).
|
Package accesskeys implements the aws.iam_access_key source plugin: lists IAM users in one AWS account, then their programmatic access keys, and emits one iam_access_key evidence record per key — suitable for SOC 2 CC6 key-hygiene policies (rotation age, unused-key detection, never-used-active keys). |
|
aws/acm
Package acm implements the aws.acm source plugin: lists ACM certificates and emits tls_certificate evidence records with cross-vendor expiry, managed-status, and auto-renewal attributes.
|
Package acm implements the aws.acm source plugin: lists ACM certificates and emits tls_certificate evidence records with cross-vendor expiry, managed-status, and auto-renewal attributes. |
|
aws/backup
Package backup implements the aws.backup source plugin: lists AWS Backup plans and emits backup_plan evidence records with cross-vendor activeness and retention attributes.
|
Package backup implements the aws.backup source plugin: lists AWS Backup plans and emits backup_plan evidence records with cross-vendor activeness and retention attributes. |
|
aws/cloudtrail
Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes.
|
Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes. |
|
aws/cloudwatch
Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes.
|
Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes. |
|
aws/config
Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits config_change_tracking evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
|
Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits config_change_tracking evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording). |
|
aws/dynamodb
Package dynamodb implements the aws.dynamodb source plugin: lists DynamoDB tables and emits nosql_table evidence records with cross-vendor encryption, point-in-time-recovery, and deletion-protection attributes.
|
Package dynamodb implements the aws.dynamodb source plugin: lists DynamoDB tables and emits nosql_table evidence records with cross-vendor encryption, point-in-time-recovery, and deletion-protection attributes. |
|
aws/ec2
Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes.
|
Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes. |
|
aws/ecr
Package ecr implements the aws.ecr source plugin: lists ECR repositories in the private registry and emits container_registry evidence records with cross-vendor scan-on-push, public-exposure, immutability, and encryption attributes.
|
Package ecr implements the aws.ecr source plugin: lists ECR repositories in the private registry and emits container_registry evidence records with cross-vendor scan-on-push, public-exposure, immutability, and encryption attributes. |
|
aws/eks
Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
|
Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume. |
|
aws/guardduty
Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
|
Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled). |
|
aws/iam
Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
|
Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …). |
|
aws/inspector
Package inspector implements the aws.inspector source plugin: lists AWS Inspector2 findings and emits vulnerability_finding evidence records with cross-vendor severity, status, CVE, and remediation attributes.
|
Package inspector implements the aws.inspector source plugin: lists AWS Inspector2 findings and emits vulnerability_finding evidence records with cross-vendor severity, status, CVE, and remediation attributes. |
|
aws/kms
Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
|
Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume. |
|
aws/lambda
Package lambda implements the aws.lambda source plugin: lists AWS Lambda functions and emits serverless_function evidence records with cross-vendor VPC-placement, tracing, and environment-variable-encryption attributes.
|
Package lambda implements the aws.lambda source plugin: lists AWS Lambda functions and emits serverless_function evidence records with cross-vendor VPC-placement, tracing, and environment-variable-encryption attributes. |
|
aws/passwordpolicy
Package passwordpolicy implements the aws.password_policy source plugin: reads the IAM account password policy and emits a single password_policy evidence record describing minimum length, expiry, reuse prevention, and the four character-class requirements.
|
Package passwordpolicy implements the aws.password_policy source plugin: reads the IAM account password policy and emits a single password_policy evidence record describing minimum length, expiry, reuse prevention, and the four character-class requirements. |
|
aws/rds
Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes.
|
Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes. |
|
aws/s3
Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores.
|
Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores. |
|
aws/secretsmanager
Package secretsmanager implements the aws.secretsmanager source plugin: lists AWS Secrets Manager secrets and emits secret evidence records with cross-vendor rotation and encryption attributes.
|
Package secretsmanager implements the aws.secretsmanager source plugin: lists AWS Secrets Manager secrets and emits secret evidence records with cross-vendor rotation and encryption attributes. |
|
aws/securityalert
Package securityalert implements the aws.security_alert source plugin.
|
Package securityalert implements the aws.security_alert source plugin. |
|
aws/securitygroups
Package securitygroups implements the aws.security_group source plugin: lists EC2 security groups in one AWS account and emits one firewall_rule evidence record per ingress/egress rule, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate.
|
Package securitygroups implements the aws.security_group source plugin: lists EC2 security groups in one AWS account and emits one firewall_rule evidence record per ingress/egress rule, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate. |
|
aws/securityservices
Package securityservices implements the aws.security_services source plugin: probes account-level enablement of AWS Macie, Inspector, and SecurityHub and emits one security_service evidence record per service.
|
Package securityservices implements the aws.security_services source plugin: probes account-level enablement of AWS Macie, Inspector, and SecurityHub and emits one security_service evidence record per service. |
|
aws/vpc
Package vpc implements the aws.vpc source plugin: lists VPCs in one AWS account and emits network evidence records carrying the cross-vendor flow-logging / default-network attributes policies check.
|
Package vpc implements the aws.vpc source plugin: lists VPCs in one AWS account and emits network evidence records carrying the cross-vendor flow-logging / default-network attributes policies check. |
|
builtin
Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
|
Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry. |
|
gcp/compute
Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
|
Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …). |
|
gcp/iam
Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
|
Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users. |
|
gcp/sql
Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
|
Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc. |
|
gcp/storage
Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
|
Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration. |
|
github
Package github implements the github source plugin: lists repositories and organization members from a single GitHub organization and emits two evidence types — github_repository and github_org_member — suitable for SOC 2 branch-protection and 2FA coverage policies.
|
Package github implements the github source plugin: lists repositories and organization members from a single GitHub organization and emits two evidence types — github_repository and github_org_member — suitable for SOC 2 branch-protection and 2FA coverage policies. |
|
manual
Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry.
|
Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry. |
|
manual/azureblob
Package azureblob implements the manual.pdf Reader on Azure Blob Storage.
|
Package azureblob implements the manual.pdf Reader on Azure Blob Storage. |
|
manual/builtin
Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry.
|
Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry. |
|
manual/fileconv
Package fileconv converts common image formats to PDF bytes.
|
Package fileconv converts common image formats to PDF bytes. |
|
manual/gcs
Package gcs implements the manual.pdf Reader on Google Cloud Storage.
|
Package gcs implements the manual.pdf Reader on Google Cloud Storage. |
|
manual/pdfmerge
Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu.
|
Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu. |
|
manual/s3
Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
|
Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle). |
|
okta
Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits two evidence types — okta_user and okta_app — suitable for SOC 2 MFA coverage policies.
|
Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits two evidence types — okta_user and okta_app — suitable for SOC 2 MFA coverage policies. |
|
Package spec is L0 of the SigComply CLI: parsers and validators for the declarative artifacts that drive the engine — framework specs, policy specs, evidence type schemas, source plugin manifests, the project config (.sigcomply.yaml), and the manual evidence catalog.
|
Package spec is L0 of the SigComply CLI: parsers and validators for the declarative artifacts that drive the engine — framework specs, policy specs, evidence type schemas, source plugin manifests, the project config (.sigcomply.yaml), and the manual evidence catalog. |
|
Package submitter is L8 of the SigComply CLI: optional cloud submission.
|
Package submitter is L8 of the SigComply CLI: optional cloud submission. |
|
Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results, attachments, and run manifests to the customer's storage backend.
|
Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results, attachments, and run manifests to the customer's storage backend. |
|
azureblob
Package azureblob implements core.Vault on Azure Blob Storage.
|
Package azureblob implements core.Vault on Azure Blob Storage. |
|
builtin
Package builtin imports every in-tree vault backend for the side effect of running its init() — which registers a Factory under the vault.RegisterBackend registry.
|
Package builtin imports every in-tree vault backend for the side effect of running its init() — which registers a Factory under the vault.RegisterBackend registry. |
|
gcs
Package gcs implements core.Vault on Google Cloud Storage.
|
Package gcs implements core.Vault on Google Cloud Storage. |
|
local
Package local implements core.Vault on the local filesystem.
|
Package local implements core.Vault on the local filesystem. |
|
s3
Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
|
Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle). |
|
vaulttest
Package vaulttest provides a backend-agnostic test suite for the core.Vault interface.
|
Package vaulttest provides a backend-agnostic test suite for the core.Vault interface. |
Click to show internal directories.
Click to hide internal directories.