Documentation
¶
Overview ¶
Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results, attachments, and run manifests to the customer's storage backend. The customer's vault — never the CLI's — receives every signed evidence envelope, every PDF mirror, every run manifest. The CLI is the writer; auditors and the optional Cloud dashboard are the readers.
Backend implementations: local, s3, gcs, azure_blob — all behind the core.Vault interface. Selection is by self-registering factory: each backend's package init() calls vault.RegisterBackend, and internal/vault/builtin blank-imports them all so cmd/sigcomply pulls in every in-tree backend with one import line. Third-party backends (SFTP, MinIO, on-prem NFS, custom object stores) follow the same pattern from a project-local plugin compiled in by `sigcomply build` (M16) — no edits to internal/vault required.
The CLI never reads from the vault during the same run.
See docs/architecture/00-three-plugin-axes.md §Axis B, docs/architecture/02-layers.md, 05-vault-layout.md, and 07-extensibility.md §Custom vault backends.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func FromConfig ¶
FromConfig constructs the right backend for the given project-config vault section. The returned Vault is already Init'd and ready for Put/Get/List. The factory layer is L7's seam to L8 (Orchestrator): every other layer takes a core.Vault and doesn't care which backend is behind it.
Backend selection goes through the package-global registry: each in-tree backend registers itself via init(), and the orchestrator blank-imports internal/vault/builtin to pull them all in. Third parties add custom backends the same way — see docs/architecture/07-extensibility.md §Custom vault backends.
func IDs ¶ added in v0.20.5
func IDs() []string
IDs returns every registered backend ID in sorted order. Used to build helpful error messages when project config names an unknown backend.
func RegisterBackend ¶ added in v0.20.5
RegisterBackend adds a Factory under id. Intended for an init() call in the backend's package. Duplicate IDs panic at process start — duplicates among in-tree backends are a programming error, and a project-local backend claiming a reserved ID is a misconfiguration the build should not let through.
Types ¶
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package azureblob implements core.Vault on Azure Blob Storage.
|
Package azureblob implements core.Vault on Azure Blob Storage. |
|
Package builtin imports every in-tree vault backend for the side effect of running its init() — which registers a Factory under the vault.RegisterBackend registry.
|
Package builtin imports every in-tree vault backend for the side effect of running its init() — which registers a Factory under the vault.RegisterBackend registry. |
|
Package gcs implements core.Vault on Google Cloud Storage.
|
Package gcs implements core.Vault on Google Cloud Storage. |
|
Package local implements core.Vault on the local filesystem.
|
Package local implements core.Vault on the local filesystem. |
|
Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
|
Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle). |
|
Package vaulttest provides a backend-agnostic test suite for the core.Vault interface.
|
Package vaulttest provides a backend-agnostic test suite for the core.Vault interface. |