sigcomply-cli

command module
v0.20.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 24, 2026 License: Apache-2.0 Imports: 2 Imported by: 0

README

sigcomply

Zero-trust, non-custodial compliance engine — "Evidence without Access."

The sigcomply CLI runs locally in your CI/CD and turns infrastructure state into signed compliance evidence — without giving any third party access to your data, credentials, or production environment. Raw evidence stays in your own storage; only aggregated counts and pass/fail scores are submitted to the optional Compliance Dashboard.

Currently ships SOC 2 (Type II) policies; ISO 27001 is in early development. Policies are open OPA/Rego — inspect, fork, and contribute.

Install

go install github.com/SigComply/sigcomply-cli@latest

Pre-built binaries are published with each release on GitHub.

Quick start

sigcomply check --framework soc2

Auto-detects collectors based on available credentials (AWS_*, GITHUB_TOKEN, GCP ADC, …), evaluates the framework's policies locally, writes signed EvidenceEnvelope files to your storage backend, and (in CI with OIDC) submits aggregated results to the SigComply Cloud API.

Manual evidence

For evidence that isn't an API call (declarations, training certificates, HR exports), the CLI looks for a single PDF at {framework}/{evidence_id}/{period}/evidence.pdf in your storage:

sigcomply evidence catalog                    # list manual entries
sigcomply evidence init                       # scaffold the period folders
sigcomply evidence path security_awareness_training   # print where to upload a PDF

Set the framework via SIGCOMPLY_FRAMEWORK or framework: in your config file (default: soc2). The evidence subcommands take no --framework flag.

The optional Evidence SPA is a standalone helper that generates PDFs for declaration- and checklist-style entries — the CLI never talks to it. For all other manual evidence (HR exports, training certificates, scanned documents) you produce the PDF yourself and upload it to the same path.

CI/CD

Reusable workflow / CI component:

# GitHub Actions
jobs:
  compliance:
    permissions: { id-token: write, contents: read }
    uses: SigComply/sigcomply-cli/.github/workflows/compliance.yml@v1
    with: { framework: soc2 }

# GitLab CI
include:
  - component: gitlab.com/sigcomply/sigcomply-cli/compliance@v1
    inputs: { framework: soc2 }

Documentation

License

Apache-2.0 — see LICENSE.

Documentation

Overview

SigComply CLI - Compliance automation without infrastructure access

Source Files

View all Source files

Directories

Path Synopsis
cmd
sigcomply
Package cmd is the CLI entry.
 Package cmd is the CLI entry.
internal
aggregator
Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []core.PolicyResult into the structurally counts-only core.SubmissionPayload that the cloud submitter consumes.
 Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []core.PolicyResult into the structurally counts-only core.SubmissionPayload that the cloud submitter consumes.
collector
Package collector is L4 of the SigComply CLI.
 Package collector is L4 of the SigComply CLI.
core
Package core is L1 of the SigComply CLI: the frozen Go interfaces and structs that every higher layer depends on.
 Package core is L1 of the SigComply CLI: the frozen Go interfaces and structs that every higher layer depends on.
evaluator
Package evaluator is L5 of the SigComply CLI: runs each policy's rule against the records collected for it and emits a PolicyResult.
 Package evaluator is L5 of the SigComply CLI: runs each policy's rule against the records collected for it and emits a PolicyResult.
evidence_types
Package evidence_types holds the in-tree evidence-type schemas (JSON Schema documents) and exposes the loader that registers them into the orchestrator's EvidenceType registry at bootstrap.
 Package evidence_types holds the in-tree evidence-type schemas (JSON Schema documents) and exposes the loader that registers them into the orchestrator's EvidenceType registry at bootstrap.
frameworks/iso27001
Package iso27001 is the ISO/IEC 27001:2022 framework skeleton.
 Package iso27001 is the ISO/IEC 27001:2022 framework skeleton.
frameworks/soc2
Package soc2 is the SOC 2 framework skeleton: a Framework implementation, the control catalog, and the seed policies that demonstrate every L0–L9 seam works end-to-end.
 Package soc2 is the SOC 2 framework skeleton: a Framework implementation, the control catalog, and the seed policies that demonstrate every L0–L9 seam works end-to-end.
log
Package log is the cross-cutting redaction logger.
 Package log is the cross-cutting redaction logger.
orchestrator
Package orchestrator is L9 of the SigComply CLI: wires L3 through L8 for the `sigcomply check` command — config load, registry init, plan, collect, evaluate, persist, aggregate, submit, render.
 Package orchestrator is L9 of the SigComply CLI: wires L3 through L8 for the `sigcomply check` command — config load, registry init, plan, collect, evaluate, persist, aggregate, submit, render.
planner
Package planner is L3 of the SigComply CLI: reads the project config plus the selected framework plus the registries and produces a fully resolved RunPlan — slot bindings, effective parameters, resolved exceptions, derived period.
 Package planner is L3 of the SigComply CLI: reads the project config plus the selected framework plus the registries and produces a fully resolved RunPlan — slot bindings, effective parameters, resolved exceptions, derived period.
registry
Package registry is L2 of the SigComply CLI: in-process catalogs of the things that can be referenced by ID — frameworks, source plugins, rules, evidence types, and policies.
 Package registry is L2 of the SigComply CLI: in-process catalogs of the things that can be referenced by ID — frameworks, source plugins, rules, evidence types, and policies.
report
Package report implements `sigcomply report`: the read-only, auditor-facing snapshot tool.
 Package report implements `sigcomply report`: the read-only, auditor-facing snapshot tool.
sign
Package sign is the cross-cutting signing primitive: per-file ephemeral Ed25519 keypair generation, canonical JSON encoding (RFC 8785-style), and envelope signing/verification.
 Package sign is the cross-cutting signing primitive: per-file ephemeral Ed25519 keypair generation, canonical JSON encoding (RFC 8785-style), and envelope signing/verification.
sources
Package sources holds the process-global factory registry used to instantiate SourcePlugin values from project configuration.
 Package sources holds the process-global factory registry used to instantiate SourcePlugin values from project configuration.
sources/aws/cloudtrail
Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails in one AWS account along with each trail's logging status, and emits cloudtrail_trail evidence records suitable for SOC 2 audit-logging policies (multi-region coverage, logging enablement, log file validation).
 Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails in one AWS account along with each trail's logging status, and emits cloudtrail_trail evidence records suitable for SOC 2 audit-logging policies (multi-region coverage, logging enablement, log file validation).
sources/aws/cloudwatch
Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups in one AWS account and emits cloudwatch_log_group evidence records suitable for SOC 2 audit-logging policies (retention configured, encryption at rest).
 Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups in one AWS account and emits cloudwatch_log_group evidence records suitable for SOC 2 audit-logging policies (retention configured, encryption at rest).
sources/aws/config
Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits config_recorder evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
 Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits config_recorder evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
sources/aws/ec2
Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits ec2_instance evidence records carrying the network-exposure attributes that SOC 2 CC6.6 policies consume.
 Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits ec2_instance evidence records carrying the network-exposure attributes that SOC 2 CC6.6 policies consume.
sources/aws/eks
Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits eks_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
 Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits eks_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
sources/aws/guardduty
Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits guardduty_detector evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
 Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits guardduty_detector evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
sources/aws/iam
Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
 Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
sources/aws/kms
Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
 Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
sources/aws/rds
Package rds implements the aws.rds source plugin: lists RDS DB instances in one AWS account and emits rds_instance evidence records carrying encryption and engine attributes that SOC 2 CC6.7 policies consume.
 Package rds implements the aws.rds source plugin: lists RDS DB instances in one AWS account and emits rds_instance evidence records carrying encryption and engine attributes that SOC 2 CC6.7 policies consume.
sources/aws/s3
Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits s3_bucket evidence records carrying the security-relevant default-encryption attributes that SOC 2 CC6.7 policies consume.
 Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits s3_bucket evidence records carrying the security-relevant default-encryption attributes that SOC 2 CC6.7 policies consume.
sources/builtin
Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
 Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
sources/gcp/compute
Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
 Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
sources/gcp/iam
Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one gcp_iam_binding evidence record per (role, member) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
 Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one gcp_iam_binding evidence record per (role, member) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
sources/gcp/sql
Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one cloudsql_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
 Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one cloudsql_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
sources/gcp/storage
Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
 Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
sources/github
Package github implements the github source plugin: lists repositories and organization members from a single GitHub organization and emits two evidence types — github_repository and github_org_member — suitable for SOC 2 branch-protection and 2FA coverage policies.
 Package github implements the github source plugin: lists repositories and organization members from a single GitHub organization and emits two evidence types — github_repository and github_org_member — suitable for SOC 2 branch-protection and 2FA coverage policies.
sources/manual
Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded PDFs from the project's configured manual-evidence backend and emits a small signed_document manifest record for each.
 Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded PDFs from the project's configured manual-evidence backend and emits a small signed_document manifest record for each.
sources/okta
Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits two evidence types — okta_user and okta_app — suitable for SOC 2 MFA coverage policies.
 Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits two evidence types — okta_user and okta_app — suitable for SOC 2 MFA coverage policies.
spec
Package spec is L0 of the SigComply CLI: parsers and validators for the declarative artifacts that drive the engine — framework specs, policy specs, evidence type schemas, source plugin manifests, the project config (.sigcomply.yaml), and the manual evidence catalog.
 Package spec is L0 of the SigComply CLI: parsers and validators for the declarative artifacts that drive the engine — framework specs, policy specs, evidence type schemas, source plugin manifests, the project config (.sigcomply.yaml), and the manual evidence catalog.
submitter
Package submitter is L8 of the SigComply CLI: optional cloud submission.
 Package submitter is L8 of the SigComply CLI: optional cloud submission.
vault
Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results, attachments, and run manifests to the customer's storage backend.
 Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results, attachments, and run manifests to the customer's storage backend.
vault/azureblob
Package azureblob implements core.Vault on Azure Blob Storage.
 Package azureblob implements core.Vault on Azure Blob Storage.
vault/gcs
Package gcs implements core.Vault on Google Cloud Storage.
 Package gcs implements core.Vault on Google Cloud Storage.
vault/local
Package local implements core.Vault on the local filesystem.
 Package local implements core.Vault on the local filesystem.
vault/s3
Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
 Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
vault/vaulttest
Package vaulttest provides a backend-agnostic test suite for the core.Vault interface.
 Package vaulttest provides a backend-agnostic test suite for the core.Vault interface.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.