sigcomply-cli

command module
v0.26.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 28, 2026 License: Apache-2.0 Imports: 2 Imported by: 0

README

sigcomply

Zero-trust, non-custodial compliance engine — "Evidence without Access."

The sigcomply CLI runs locally in your CI/CD and turns infrastructure state into signed compliance evidence — without giving any third party access to your data, credentials, or production environment. Raw evidence stays in your own storage; only aggregated counts and pass/fail scores are submitted to the optional Compliance Dashboard.

Currently ships SOC 2 (Type II) policies; ISO 27001 is in early development. Policies are open OPA/Rego — inspect, fork, and contribute.

Install

go install github.com/SigComply/sigcomply-cli@latest

Pre-built binaries are published with each release on GitHub.

Quick start

sigcomply check --framework soc2

Auto-detects collectors based on available credentials (AWS_*, GITHUB_TOKEN, GCP ADC, …), evaluates the framework's policies locally, writes signed EvidenceEnvelope files to your storage backend, and (in CI with OIDC) submits aggregated results to the SigComply Cloud API.

Project model

One project = one source-control repository = one compliance framework. A project is the GitHub or GitLab repo you run sigcomply in. Its .sigcomply.yaml selects exactly one framework (framework: soc2). Customers pursuing multiple frameworks (e.g. SOC 2 + ISO 27001) use multiple repos — one per framework — each with its own config, CI workflow, and evidence vault.

Manual evidence

For evidence that isn't an API call (declarations, training certificates, HR exports), the CLI scans a folder in your storage:

{bucket}/{prefix}/{evidence_catalog_id}/{period_id}/

Upload any number of files — PDF, JPEG, PNG, GIF, TIFF, WebP, or BMP. Images are auto-converted to PDF; all files are merged into one before evaluation.

sigcomply evidence catalog                    # list manual entries
sigcomply evidence init                       # scaffold the period folders
sigcomply evidence path security_awareness_training   # print the folder URI to upload to

Set the framework via SIGCOMPLY_FRAMEWORK or framework: in your config file (default: soc2). The evidence subcommands take no --framework flag.

The optional Evidence SPA is a standalone helper that generates PDFs for declaration- and checklist-style entries — the CLI never talks to it. For all other manual evidence (HR exports, training certificates, scanned documents) you produce the file yourself and upload it to the folder above.

CI/CD

Reusable workflow / CI component:

# GitHub Actions
jobs:
  compliance:
    permissions: { id-token: write, contents: read }
    uses: SigComply/sigcomply-cli/.github/workflows/compliance.yml@v1
    with: { framework: soc2 }

# GitLab CI
include:
  - component: gitlab.com/sigcomply/sigcomply-cli/compliance@v1
    inputs: { framework: soc2 }

Documentation

License

Apache-2.0 — see LICENSE.

Documentation

Overview

SigComply CLI - Compliance automation without infrastructure access

Source Files

View all Source files

Directories

Path Synopsis
cmd
sigcomply
Package cmd is the CLI entry.
 Package cmd is the CLI entry.
internal
aggregator
Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []core.PolicyResult into the structurally counts-only core.SubmissionPayload that the cloud submitter consumes.
 Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []core.PolicyResult into the structurally counts-only core.SubmissionPayload that the cloud submitter consumes.
collector
Package collector is L4 of the SigComply CLI.
 Package collector is L4 of the SigComply CLI.
core
Package core is L1 of the SigComply CLI: the frozen Go interfaces and structs that every higher layer depends on.
 Package core is L1 of the SigComply CLI: the frozen Go interfaces and structs that every higher layer depends on.
evaluator
Package evaluator is L5 of the SigComply CLI: runs each policy's rule against the records collected for it and emits a PolicyResult.
 Package evaluator is L5 of the SigComply CLI: runs each policy's rule against the records collected for it and emits a PolicyResult.
evidence_types
Package evidencetypes holds the in-tree evidence-type schemas (JSON Schema documents) and exposes the loader that registers them into the orchestrator's EvidenceType registry at bootstrap.
 Package evidencetypes holds the in-tree evidence-type schemas (JSON Schema documents) and exposes the loader that registers them into the orchestrator's EvidenceType registry at bootstrap.
frameworks/iso27001
Package iso27001 is the ISO/IEC 27001:2022 framework: the Annex A control catalog, the automated technological-control policies in the pass_when: DSL, and the manual-evidence policies across the organizational, people, physical, and technological themes.
 Package iso27001 is the ISO/IEC 27001:2022 framework: the Annex A control catalog, the automated technological-control policies in the pass_when: DSL, and the manual-evidence policies across the organizational, people, physical, and technological themes.
frameworks/soc2
Package soc2 is the SOC 2 (TSC 2017) framework: the control catalog, the automated policy library expressed in the pass_when: DSL, the manual-evidence policies, and the handful of Go rules for checks the DSL cannot express (CloudWatch metric-filter substring matching).
 Package soc2 is the SOC 2 (TSC 2017) framework: the control catalog, the automated policy library expressed in the pass_when: DSL, the manual-evidence policies, and the handful of Go rules for checks the DSL cannot express (CloudWatch metric-filter substring matching).
log
Package log is the cross-cutting redaction logger.
 Package log is the cross-cutting redaction logger.
orchestrator
Package orchestrator is L9 of the SigComply CLI: wires L3 through L8 for the `sigcomply check` command — config load, registry init, plan, collect, evaluate, persist, aggregate, submit, render.
 Package orchestrator is L9 of the SigComply CLI: wires L3 through L8 for the `sigcomply check` command — config load, registry init, plan, collect, evaluate, persist, aggregate, submit, render.
planner
Package planner is L3 of the SigComply CLI: reads the project config plus the selected framework plus the registries and produces a fully resolved RunPlan — slot bindings, effective parameters, resolved exceptions, derived period.
 Package planner is L3 of the SigComply CLI: reads the project config plus the selected framework plus the registries and produces a fully resolved RunPlan — slot bindings, effective parameters, resolved exceptions, derived period.
registry
Package registry is L2 of the SigComply CLI: in-process catalogs of the things that can be referenced by ID — frameworks, source plugins, rules, evidence types, and policies.
 Package registry is L2 of the SigComply CLI: in-process catalogs of the things that can be referenced by ID — frameworks, source plugins, rules, evidence types, and policies.
report
Package report implements `sigcomply report`: the read-only, auditor-facing snapshot tool.
 Package report implements `sigcomply report`: the read-only, auditor-facing snapshot tool.
sign
Package sign is the cross-cutting signing primitive: per-file ephemeral Ed25519 keypair generation, canonical JSON encoding (RFC 8785-style), and envelope signing/verification.
 Package sign is the cross-cutting signing primitive: per-file ephemeral Ed25519 keypair generation, canonical JSON encoding (RFC 8785-style), and envelope signing/verification.
sources
Package sources holds the process-global factory registry used to instantiate SourcePlugin values from project configuration.
 Package sources holds the process-global factory registry used to instantiate SourcePlugin values from project configuration.
sources/aws/cloudtrail
Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes.
 Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes.
sources/aws/cloudwatch
Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes.
 Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes.
sources/aws/config
Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits configuration_recorder evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
 Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits configuration_recorder evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
sources/aws/ec2
Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes.
 Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes.
sources/aws/eks
Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
 Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
sources/aws/guardduty
Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
 Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
sources/aws/iam
Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
 Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
sources/aws/kms
Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
 Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
sources/aws/rds
Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes.
 Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes.
sources/aws/s3
Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores.
 Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores.
sources/builtin
Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
 Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
sources/gcp/compute
Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
 Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
sources/gcp/iam
Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
 Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
sources/gcp/sql
Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
 Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
sources/gcp/storage
Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
 Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
sources/github
Package github implements the github source plugin: lists repositories and organization members from a single GitHub organization and emits two evidence types — github_repository and github_org_member — suitable for SOC 2 branch-protection and 2FA coverage policies.
 Package github implements the github source plugin: lists repositories and organization members from a single GitHub organization and emits two evidence types — github_repository and github_org_member — suitable for SOC 2 branch-protection and 2FA coverage policies.
sources/manual
Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry.
 Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry.
sources/manual/azureblob
Package azureblob implements the manual.pdf Reader on Azure Blob Storage.
 Package azureblob implements the manual.pdf Reader on Azure Blob Storage.
sources/manual/builtin
Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry.
 Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry.
sources/manual/fileconv
Package fileconv converts common image formats to PDF bytes.
 Package fileconv converts common image formats to PDF bytes.
sources/manual/gcs
Package gcs implements the manual.pdf Reader on Google Cloud Storage.
 Package gcs implements the manual.pdf Reader on Google Cloud Storage.
sources/manual/pdfmerge
Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu.
 Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu.
sources/manual/s3
Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
 Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
sources/okta
Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits two evidence types — okta_user and okta_app — suitable for SOC 2 MFA coverage policies.
 Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits two evidence types — okta_user and okta_app — suitable for SOC 2 MFA coverage policies.
spec
Package spec is L0 of the SigComply CLI: parsers and validators for the declarative artifacts that drive the engine — framework specs, policy specs, evidence type schemas, source plugin manifests, the project config (.sigcomply.yaml), and the manual evidence catalog.
 Package spec is L0 of the SigComply CLI: parsers and validators for the declarative artifacts that drive the engine — framework specs, policy specs, evidence type schemas, source plugin manifests, the project config (.sigcomply.yaml), and the manual evidence catalog.
submitter
Package submitter is L8 of the SigComply CLI: optional cloud submission.
 Package submitter is L8 of the SigComply CLI: optional cloud submission.
vault
Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results, attachments, and run manifests to the customer's storage backend.
 Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results, attachments, and run manifests to the customer's storage backend.
vault/azureblob
Package azureblob implements core.Vault on Azure Blob Storage.
 Package azureblob implements core.Vault on Azure Blob Storage.
vault/builtin
Package builtin imports every in-tree vault backend for the side effect of running its init() — which registers a Factory under the vault.RegisterBackend registry.
 Package builtin imports every in-tree vault backend for the side effect of running its init() — which registers a Factory under the vault.RegisterBackend registry.
vault/gcs
Package gcs implements core.Vault on Google Cloud Storage.
 Package gcs implements core.Vault on Google Cloud Storage.
vault/local
Package local implements core.Vault on the local filesystem.
 Package local implements core.Vault on the local filesystem.
vault/s3
Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
 Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
vault/vaulttest
Package vaulttest provides a backend-agnostic test suite for the core.Vault interface.
 Package vaulttest provides a backend-agnostic test suite for the core.Vault interface.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.