sigcomply-cli

command module
v0.54.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 16, 2026 License: Apache-2.0 Imports: 2 Imported by: 0

README

sigcomply

Zero-trust, non-custodial compliance engine — "Evidence without Access."

The sigcomply CLI runs locally in your CI/CD and turns infrastructure state into signed compliance evidence — without giving any third party access to your data, credentials, or production environment. Raw evidence stays in your own storage; only aggregated counts and pass/fail scores are submitted to the optional Compliance Dashboard.

Ships SOC 2 (Type II) and ISO/IEC 27001:2022 (all 93 Annex A controls) policy libraries. Policies are open, Go-native declarative definitions (a pass_when DSL) — inspect, fork, and contribute.

Install

curl -fsSL https://raw.githubusercontent.com/sigcomply/sigcomply-cli/main/scripts/install.sh | sh

This downloads the pre-built binary for your platform from the latest GitHub release. Alternatively, with a Go toolchain:

go install github.com/sigcomply/sigcomply-cli@latest

Quick start

sigcomply check

The framework comes from framework: in .sigcomply.yaml (or the SIGCOMPLY_FRAMEWORK env var); check has no --framework flag. Auto-detects collectors based on available credentials (AWS_*, GITHUB_TOKEN, GCP ADC, …), evaluates the framework's policies locally, writes signed EvidenceEnvelope files to your storage backend, and (in CI with OIDC) submits aggregated results to the SigComply Cloud API.

Commands

Command Purpose
sigcomply check Plan → collect → evaluate → aggregate → sign/store → submit.
sigcomply init-ci Scaffold per-cadence CI workflow files.
sigcomply build Compile a project-tailored binary with .sigcomply/ Go extensions.
sigcomply report Read-only auditor snapshot of the vault.
sigcomply evidence catalog Print the manual-evidence catalog (-o text|json).
sigcomply version Print version, commit, and build time.

Exit codes: 0 passed · 1 violations · 2 execution error · 3 configuration error.

Project model

One project = one source-control repository = one compliance framework. A project is the GitHub or GitLab repo you run sigcomply in. Its .sigcomply.yaml selects exactly one framework (framework: soc2). Customers pursuing multiple frameworks (e.g. SOC 2 + ISO 27001) use multiple repos — one per framework — each with its own config, CI workflow, and evidence vault.

Manual evidence

For evidence that isn't an API call (declarations, training certificates, HR exports), the CLI scans a folder in your storage:

{bucket}/{prefix}/{evidence_catalog_id}/{period_id}/

Upload any number of files — PDF, JPEG, PNG, GIF, TIFF, WebP, or BMP to the folder above. Images are auto-converted to PDF; all files are merged into one before evaluation. sigcomply check resolves each manual policy's folder from the framework's catalog and the active period, then scans it.

Set the framework via SIGCOMPLY_FRAMEWORK or framework: in your config file (default: soc2).

The optional Evidence SPA is a standalone helper that generates PDFs for declaration- and checklist-style entries — the CLI never talks to it. For all other manual evidence (HR exports, training certificates, scanned documents) you produce the file yourself and upload it to the folder above.

CI/CD

Run sigcomply init-ci to scaffold standalone, per-cadence workflow files calibrated to your framework's cadence distribution. On GitHub Actions it writes compliance-{daily,weekly,monthly,quarterly,annual,on-push}.yml under .github/workflows/; each downloads the binary from GitHub Releases and runs sigcomply check for that cadence.

Copy-paste starting points also live under examples/: examples/github-actions/{basic,multi-environment}.yml and examples/gitlab-ci.yml. A first-class packaged GitLab CI component is not yet available — copy or include: the example pipeline.

Documentation

License

Apache-2.0 — see LICENSE.

Documentation

Overview

SigComply CLI - Compliance automation without infrastructure access

Source Files

View all Source files

Directories

Path Synopsis
cmd
sigcomply
Package cmd is the CLI entry.
 Package cmd is the CLI entry.
internal
aggregator
Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []core.PolicyResult into the structurally counts-only core.SubmissionPayload that the cloud submitter consumes.
 Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []core.PolicyResult into the structurally counts-only core.SubmissionPayload that the cloud submitter consumes.
collector
Package collector is L4 of the SigComply CLI.
 Package collector is L4 of the SigComply CLI.
core
Package core is L1 of the SigComply CLI: the frozen Go interfaces and structs that every higher layer depends on.
 Package core is L1 of the SigComply CLI: the frozen Go interfaces and structs that every higher layer depends on.
evaluator
Package evaluator is L5 of the SigComply CLI: runs each policy's rule against the records collected for it and emits a PolicyResult.
 Package evaluator is L5 of the SigComply CLI: runs each policy's rule against the records collected for it and emits a PolicyResult.
evidence_types
Package evidencetypes holds the in-tree evidence-type schemas (JSON Schema documents) and exposes the loader that registers them into the orchestrator's EvidenceType registry at bootstrap.
 Package evidencetypes holds the in-tree evidence-type schemas (JSON Schema documents) and exposes the loader that registers them into the orchestrator's EvidenceType registry at bootstrap.
frameworks
Package frameworks holds the process-global registry of compliance framework factories.
 Package frameworks holds the process-global registry of compliance framework factories.
frameworks/builtin
Package builtin imports every in-tree framework for the side effect of running its init() — which registers a Factory with the frameworks registry.
 Package builtin imports every in-tree framework for the side effect of running its init() — which registers a Factory with the frameworks registry.
frameworks/iso27001
Package iso27001 is the ISO/IEC 27001:2022 framework: the Annex A control catalog, the automated technological-control policies in the pass_when: DSL, and the manual-evidence policies across the organizational, people, physical, and technological themes.
 Package iso27001 is the ISO/IEC 27001:2022 framework: the Annex A control catalog, the automated technological-control policies in the pass_when: DSL, and the manual-evidence policies across the organizational, people, physical, and technological themes.
frameworks/soc2
Package soc2 is the SOC 2 (TSC 2017) framework: the control catalog, the automated policy library expressed in the pass_when: DSL, and the manual-evidence policies.
 Package soc2 is the SOC 2 (TSC 2017) framework: the control catalog, the automated policy library expressed in the pass_when: DSL, and the manual-evidence policies.
log
Package log is the cross-cutting redaction logger.
 Package log is the cross-cutting redaction logger.
manualcatalog
Package manualcatalog defines the descriptive, presentation-facing manual-evidence catalog that `sigcomply evidence catalog` exports as JSON.
 Package manualcatalog defines the descriptive, presentation-facing manual-evidence catalog that `sigcomply evidence catalog` exports as JSON.
orchestrator
Package orchestrator is L9 of the SigComply CLI: wires L3 through L8 for the `sigcomply check` command — config load, registry init, plan, collect, evaluate, persist, aggregate, submit, render.
 Package orchestrator is L9 of the SigComply CLI: wires L3 through L8 for the `sigcomply check` command — config load, registry init, plan, collect, evaluate, persist, aggregate, submit, render.
planner
Package planner is L3 of the SigComply CLI: reads the project config plus the selected framework plus the registries and produces a fully resolved RunPlan — slot bindings, effective parameters, resolved exceptions, derived period.
 Package planner is L3 of the SigComply CLI: reads the project config plus the selected framework plus the registries and produces a fully resolved RunPlan — slot bindings, effective parameters, resolved exceptions, derived period.
registry
Package registry is L2 of the SigComply CLI: in-process catalogs of the things that can be referenced by ID — frameworks, source plugins, rules, evidence types, and policies.
 Package registry is L2 of the SigComply CLI: in-process catalogs of the things that can be referenced by ID — frameworks, source plugins, rules, evidence types, and policies.
report
Package report implements `sigcomply report`: the read-only, auditor-facing snapshot tool.
 Package report implements `sigcomply report`: the read-only, auditor-facing snapshot tool.
sign
Package sign is the cross-cutting signing primitive: per-file ephemeral Ed25519 keypair generation, canonical JSON encoding (RFC 8785-style), and envelope signing/verification.
 Package sign is the cross-cutting signing primitive: per-file ephemeral Ed25519 keypair generation, canonical JSON encoding (RFC 8785-style), and envelope signing/verification.
sources
Package sources holds the process-global factory registry used to instantiate SourcePlugin values from project configuration.
 Package sources holds the process-global factory registry used to instantiate SourcePlugin values from project configuration.
sources/aws/accesskeys
Package accesskeys implements the aws.iam_access_key source plugin: lists IAM users in one AWS account, then their programmatic access keys, and emits one iam_access_key evidence record per key — suitable for SOC 2 CC6 key-hygiene policies (rotation age, unused-key detection, never-used-active keys).
 Package accesskeys implements the aws.iam_access_key source plugin: lists IAM users in one AWS account, then their programmatic access keys, and emits one iam_access_key evidence record per key — suitable for SOC 2 CC6 key-hygiene policies (rotation age, unused-key detection, never-used-active keys).
sources/aws/acm
Package acm implements the aws.acm source plugin: lists ACM certificates and emits tls_certificate evidence records with cross-vendor expiry, managed-status, and auto-renewal attributes.
 Package acm implements the aws.acm source plugin: lists ACM certificates and emits tls_certificate evidence records with cross-vendor expiry, managed-status, and auto-renewal attributes.
sources/aws/backup
Package backup implements the aws.backup source plugin: lists AWS Backup plans and emits backup_plan evidence records with cross-vendor activeness and retention attributes.
 Package backup implements the aws.backup source plugin: lists AWS Backup plans and emits backup_plan evidence records with cross-vendor activeness and retention attributes.
sources/aws/cloudtrail
Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes.
 Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes.
sources/aws/cloudwatch
Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes.
 Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes.
sources/aws/config
Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits config_change_tracking evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
 Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits config_change_tracking evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
sources/aws/dynamodb
Package dynamodb implements the aws.dynamodb source plugin: lists DynamoDB tables and emits nosql_table evidence records with cross-vendor encryption, point-in-time-recovery, and deletion-protection attributes.
 Package dynamodb implements the aws.dynamodb source plugin: lists DynamoDB tables and emits nosql_table evidence records with cross-vendor encryption, point-in-time-recovery, and deletion-protection attributes.
sources/aws/ec2
Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes.
 Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes.
sources/aws/ecr
Package ecr implements the aws.ecr source plugin: lists ECR repositories in the private registry and emits container_registry evidence records with cross-vendor scan-on-push, public-exposure, immutability, and encryption attributes.
 Package ecr implements the aws.ecr source plugin: lists ECR repositories in the private registry and emits container_registry evidence records with cross-vendor scan-on-push, public-exposure, immutability, and encryption attributes.
sources/aws/eks
Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
 Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
sources/aws/guardduty
Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
 Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
sources/aws/iam
Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
 Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
sources/aws/inspector
Package inspector implements the aws.inspector source plugin: lists AWS Inspector2 findings and emits vulnerability_finding evidence records with cross-vendor severity, status, CVE, and remediation attributes.
 Package inspector implements the aws.inspector source plugin: lists AWS Inspector2 findings and emits vulnerability_finding evidence records with cross-vendor severity, status, CVE, and remediation attributes.
sources/aws/kms
Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
 Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
sources/aws/lambda
Package lambda implements the aws.lambda source plugin: lists AWS Lambda functions and emits serverless_function evidence records with cross-vendor VPC-placement, tracing, and environment-variable-encryption attributes.
 Package lambda implements the aws.lambda source plugin: lists AWS Lambda functions and emits serverless_function evidence records with cross-vendor VPC-placement, tracing, and environment-variable-encryption attributes.
sources/aws/passwordpolicy
Package passwordpolicy implements the aws.password_policy source plugin: reads the IAM account password policy and emits a single password_policy evidence record describing minimum length, expiry, reuse prevention, and the four character-class requirements.
 Package passwordpolicy implements the aws.password_policy source plugin: reads the IAM account password policy and emits a single password_policy evidence record describing minimum length, expiry, reuse prevention, and the four character-class requirements.
sources/aws/rds
Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes.
 Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes.
sources/aws/s3
Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores.
 Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores.
sources/aws/secretsmanager
Package secretsmanager implements the aws.secretsmanager source plugin: lists AWS Secrets Manager secrets and emits secret evidence records with cross-vendor rotation and encryption attributes.
 Package secretsmanager implements the aws.secretsmanager source plugin: lists AWS Secrets Manager secrets and emits secret evidence records with cross-vendor rotation and encryption attributes.
sources/aws/securityalert
Package securityalert implements the aws.security_alert source plugin.
 Package securityalert implements the aws.security_alert source plugin.
sources/aws/securitygroups
Package securitygroups implements the aws.security_group source plugin: lists EC2 security groups in one AWS account and emits one firewall_rule evidence record per ingress/egress rule, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate.
 Package securitygroups implements the aws.security_group source plugin: lists EC2 security groups in one AWS account and emits one firewall_rule evidence record per ingress/egress rule, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate.
sources/aws/securityservices
Package securityservices implements the aws.security_services source plugin: probes account-level enablement of AWS Macie, Inspector, and SecurityHub and emits one security_service evidence record per service.
 Package securityservices implements the aws.security_services source plugin: probes account-level enablement of AWS Macie, Inspector, and SecurityHub and emits one security_service evidence record per service.
sources/aws/vpc
Package vpc implements the aws.vpc source plugin: lists VPCs in one AWS account and emits network evidence records carrying the cross-vendor flow-logging / default-network attributes policies check.
 Package vpc implements the aws.vpc source plugin: lists VPCs in one AWS account and emits network evidence records carrying the cross-vendor flow-logging / default-network attributes policies check.
sources/azure/entra
Package entra implements the azure.entra source plugin: lists Microsoft Entra ID (Azure AD) users via Microsoft Graph and emits one cross-vendor directory_user record per user, so MFA, admin, and lifecycle policies (e.g.
 Package entra implements the azure.entra source plugin: lists Microsoft Entra ID (Azure AD) users via Microsoft Graph and emits one cross-vendor directory_user record per user, so MFA, admin, and lifecycle policies (e.g.
sources/azure/internal/azcommon
Package azcommon is the shared credential, subscription, and resource-graph foundation reused by every azure.* source plugin (WU-5.0).
 Package azcommon is the shared credential, subscription, and resource-graph foundation reused by every azure.* source plugin (WU-5.0).
sources/azure/storage
Package storage implements the azure.storage source plugin: lists every Azure Storage account in a subscription and emits one cross-vendor object_storage_bucket record per account, so encryption-at-rest, public-access, and versioning policies evaluate against Azure exactly as they do against AWS S3 and GCS — zero policy changes (Invariant #4, substitutability).
 Package storage implements the azure.storage source plugin: lists every Azure Storage account in a subscription and emits one cross-vendor object_storage_bucket record per account, so encryption-at-rest, public-access, and versioning policies evaluate against Azure exactly as they do against AWS S3 and GCS — zero policy changes (Invariant #4, substitutability).
sources/builtin
Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
 Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
sources/gcp/artifactregistry
Package artifactregistry implements the gcp.artifactregistry source plugin: lists Artifact Registry repositories across every location in one GCP project and emits one container_registry evidence record per repository, carrying the scan-on-push, public-exposure, immutability, and encryption attributes the container-registry policies evaluate — the same cloud-neutral type aws.ecr emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package artifactregistry implements the gcp.artifactregistry source plugin: lists Artifact Registry repositories across every location in one GCP project and emits one container_registry evidence record per repository, carrying the scan-on-push, public-exposure, immutability, and encryption attributes the container-registry policies evaluate — the same cloud-neutral type aws.ecr emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
sources/gcp/asset
Package asset implements the gcp.asset source plugin: it emits a single config_change_tracking evidence record describing whether a GCP project has resource-change tracking configured — the same cloud-neutral type aws.config emits, so the config-recording policies (SOC2 CC7.1, ISO A.8.9) span both clouds with zero changes (Invariant #4, substitutability).
 Package asset implements the gcp.asset source plugin: it emits a single config_change_tracking evidence record describing whether a GCP project has resource-change tracking configured — the same cloud-neutral type aws.config emits, so the config-recording policies (SOC2 CC7.1, ISO A.8.9) span both clouds with zero changes (Invariant #4, substitutability).
sources/gcp/audit
Package audit implements the gcp.audit source plugin: it emits a single audit_log_trail evidence record describing a GCP project's Cloud Audit Logs posture — the same cloud-neutral type aws.cloudtrail emits, so the audit-logging policies (SOC2 CC7.1, ISO A.8.15) span both clouds with zero changes (Invariant #4, substitutability).
 Package audit implements the gcp.audit source plugin: it emits a single audit_log_trail evidence record describing a GCP project's Cloud Audit Logs posture — the same cloud-neutral type aws.cloudtrail emits, so the audit-logging policies (SOC2 CC7.1, ISO A.8.15) span both clouds with zero changes (Invariant #4, substitutability).
sources/gcp/backup
Package backup implements the gcp.backup source plugin: lists Backup and DR Service backup plans across every location in one GCP project and emits one backup_plan evidence record per plan, carrying the active / retention attributes the backup_plan policies evaluate — the same cloud-neutral type aws.backup emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package backup implements the gcp.backup source plugin: lists Backup and DR Service backup plans across every location in one GCP project and emits one backup_plan evidence record per plan, carrying the active / retention attributes the backup_plan policies evaluate — the same cloud-neutral type aws.backup emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
sources/gcp/certs
Package certs implements the gcp.certs source plugin: lists Certificate Manager certificates across every location in one GCP project and emits one tls_certificate evidence record per certificate, carrying the expiry, managed-status, and auto-renewal attributes the tls_certificate policies evaluate — the same cloud-neutral type aws.acm emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package certs implements the gcp.certs source plugin: lists Certificate Manager certificates across every location in one GCP project and emits one tls_certificate evidence record per certificate, carrying the expiry, managed-status, and auto-renewal attributes the tls_certificate policies evaluate — the same cloud-neutral type aws.acm emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
sources/gcp/compute
Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
 Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
sources/gcp/directory
Package directory implements the gcp.directory source plugin: lists Google Workspace / Cloud Identity users via the Admin SDK Directory API and emits one cross-vendor directory_user record per user so MFA, admin, and lifecycle policies (e.g.
 Package directory implements the gcp.directory source plugin: lists Google Workspace / Cloud Identity users via the Admin SDK Directory API and emits one cross-vendor directory_user record per user so MFA, admin, and lifecycle policies (e.g.
sources/gcp/firestore
Package firestore implements the gcp.firestore source plugin: lists Cloud Firestore databases in one GCP project and emits one nosql_table evidence record per database, carrying the encryption, point-in-time- recovery, and deletion-protection attributes the nosql_table policies evaluate — the same cloud-neutral type aws.dynamodb emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package firestore implements the gcp.firestore source plugin: lists Cloud Firestore databases in one GCP project and emits one nosql_table evidence record per database, carrying the encryption, point-in-time- recovery, and deletion-protection attributes the nosql_table policies evaluate — the same cloud-neutral type aws.dynamodb emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
sources/gcp/firewall
Package firewall implements the gcp.firewall source plugin: lists VPC firewall rules in one GCP project and emits one firewall_rule evidence record per protocol/port-range within each firewall, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate — the same neutral type aws.security_group emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package firewall implements the gcp.firewall source plugin: lists VPC firewall rules in one GCP project and emits one firewall_rule evidence record per protocol/port-range within each firewall, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate — the same neutral type aws.security_group emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
sources/gcp/gke
Package gke implements the gcp.gke source plugin: lists GKE (Google Kubernetes Engine) clusters across every location in one GCP project and emits one kubernetes_cluster evidence record per cluster, carrying the secrets-encryption, logging, and network-isolation attributes the kubernetes_cluster policies evaluate — the same cloud-neutral type aws.eks emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package gke implements the gcp.gke source plugin: lists GKE (Google Kubernetes Engine) clusters across every location in one GCP project and emits one kubernetes_cluster evidence record per cluster, carrying the secrets-encryption, logging, and network-isolation attributes the kubernetes_cluster policies evaluate — the same cloud-neutral type aws.eks emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
sources/gcp/iam
Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
 Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
sources/gcp/kms
Package kms implements the gcp.kms source plugin: lists Cloud KMS crypto keys across every location in one GCP project and emits one kms_key evidence record per key, carrying the rotation and manager attributes key-rotation policies evaluate — the same neutral type aws.kms emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package kms implements the gcp.kms source plugin: lists Cloud KMS crypto keys across every location in one GCP project and emits one kms_key evidence record per key, carrying the rotation and manager attributes key-rotation policies evaluate — the same neutral type aws.kms emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
sources/gcp/logging
Package logging implements the gcp.logging source plugin: lists Cloud Logging log buckets in one GCP project and emits one log_group evidence record per bucket, carrying the retention and encryption attributes the log-retention and log-encryption policies evaluate — the same cloud-neutral type aws.cloudwatch emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package logging implements the gcp.logging source plugin: lists Cloud Logging log buckets in one GCP project and emits one log_group evidence record per bucket, carrying the retention and encryption attributes the log-retention and log-encryption policies evaluate — the same cloud-neutral type aws.cloudwatch emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
sources/gcp/network
Package network implements the gcp.network source plugin: lists VPC Networks in one GCP project and emits one network evidence record per VPC, carrying the cross-vendor flow-logging / default-network attributes policies evaluate — the same neutral type aws.vpc emits, so flow-log and default-VPC-removal policies span both clouds with zero changes (Invariant #4, substitutability).
 Package network implements the gcp.network source plugin: lists VPC Networks in one GCP project and emits one network evidence record per VPC, carrying the cross-vendor flow-logging / default-network attributes policies evaluate — the same neutral type aws.vpc emits, so flow-log and default-VPC-removal policies span both clouds with zero changes (Invariant #4, substitutability).
sources/gcp/scc
Package scc implements the gcp.scc source plugin: it reads Google Security Command Center (SCC) and emits three cross-vendor evidence types so SCC-backed GCP customers satisfy the same controls as AWS customers with zero policy changes (Invariant #4, substitutability):
 Package scc implements the gcp.scc source plugin: it reads Google Security Command Center (SCC) and emits three cross-vendor evidence types so SCC-backed GCP customers satisfy the same controls as AWS customers with zero policy changes (Invariant #4, substitutability):
sources/gcp/secretmanager
Package secretmanager implements the gcp.secretmanager source plugin: lists Secret Manager secrets in one GCP project and emits one secret evidence record per secret, carrying the rotation and encryption attributes the secrets-rotation and secrets-encryption policies evaluate — the same cloud-neutral type aws.secretsmanager emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
 Package secretmanager implements the gcp.secretmanager source plugin: lists Secret Manager secrets in one GCP project and emits one secret evidence record per secret, carrying the rotation and encryption attributes the secrets-rotation and secrets-encryption policies evaluate — the same cloud-neutral type aws.secretsmanager emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
sources/gcp/sql
Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
 Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
sources/gcp/storage
Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
 Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
sources/github
Package github implements the github source plugin: lists repositories and organization members from a single GitHub organization and emits two evidence types — github_repository and github_org_member — suitable for SOC 2 branch-protection and 2FA coverage policies.
 Package github implements the github source plugin: lists repositories and organization members from a single GitHub organization and emits two evidence types — github_repository and github_org_member — suitable for SOC 2 branch-protection and 2FA coverage policies.
sources/gitlab
Package gitlab implements the gitlab source plugin: lists projects ("repositories") and members under a single GitLab group and emits the cross-vendor git_repository and directory_user evidence types — suitable for SOC 2 / ISO 27001 branch-protection, code-review, and identity (MFA/admin/lifecycle) policies.
 Package gitlab implements the gitlab source plugin: lists projects ("repositories") and members under a single GitLab group and emits the cross-vendor git_repository and directory_user evidence types — suitable for SOC 2 / ISO 27001 branch-protection, code-review, and identity (MFA/admin/lifecycle) policies.
sources/manual
Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry.
 Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry.
sources/manual/azureblob
Package azureblob implements the manual.pdf Reader on Azure Blob Storage.
 Package azureblob implements the manual.pdf Reader on Azure Blob Storage.
sources/manual/builtin
Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry.
 Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry.
sources/manual/fileconv
Package fileconv converts common image formats to PDF bytes.
 Package fileconv converts common image formats to PDF bytes.
sources/manual/gcs
Package gcs implements the manual.pdf Reader on Google Cloud Storage.
 Package gcs implements the manual.pdf Reader on Google Cloud Storage.
sources/manual/pdfmerge
Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu.
 Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu.
sources/manual/s3
Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
 Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
sources/okta
Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits two evidence types — okta_user and okta_app — suitable for SOC 2 MFA coverage policies.
 Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits two evidence types — okta_user and okta_app — suitable for SOC 2 MFA coverage policies.
spec
Package spec is L0 of the SigComply CLI: parsers and validators for the declarative artifacts that drive the engine — framework specs, policy specs, evidence type schemas, source plugin manifests, the project config (.sigcomply.yaml), and the manual evidence catalog.
 Package spec is L0 of the SigComply CLI: parsers and validators for the declarative artifacts that drive the engine — framework specs, policy specs, evidence type schemas, source plugin manifests, the project config (.sigcomply.yaml), and the manual evidence catalog.
submitter
Package submitter is L8 of the SigComply CLI: optional cloud submission.
 Package submitter is L8 of the SigComply CLI: optional cloud submission.
vault
Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results, attachments, and run manifests to the customer's storage backend.
 Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results, attachments, and run manifests to the customer's storage backend.
vault/azureblob
Package azureblob implements core.Vault on Azure Blob Storage.
 Package azureblob implements core.Vault on Azure Blob Storage.
vault/builtin
Package builtin imports every in-tree vault backend for the side effect of running its init() — which registers a Factory under the vault.RegisterBackend registry.
 Package builtin imports every in-tree vault backend for the side effect of running its init() — which registers a Factory under the vault.RegisterBackend registry.
vault/gcs
Package gcs implements core.Vault on Google Cloud Storage.
 Package gcs implements core.Vault on Google Cloud Storage.
vault/local
Package local implements core.Vault on the local filesystem.
 Package local implements core.Vault on the local filesystem.
vault/s3
Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
 Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
vault/vaulttest
Package vaulttest provides a backend-agnostic test suite for the core.Vault interface.
 Package vaulttest provides a backend-agnostic test suite for the core.Vault interface.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.