Directories
¶
| Path | Synopsis |
|---|---|
|
Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []core.PolicyResult into the structurally counts-only core.SubmissionPayload that the cloud submitter consumes.
|
Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []core.PolicyResult into the structurally counts-only core.SubmissionPayload that the cloud submitter consumes. |
|
Package collector is L4 of the SigComply CLI.
|
Package collector is L4 of the SigComply CLI. |
|
Package core is L1 of the SigComply CLI: the frozen Go interfaces and structs that every higher layer depends on.
|
Package core is L1 of the SigComply CLI: the frozen Go interfaces and structs that every higher layer depends on. |
|
Package evaluator is L5 of the SigComply CLI: runs each policy's rule against the records collected for it and emits a PolicyResult.
|
Package evaluator is L5 of the SigComply CLI: runs each policy's rule against the records collected for it and emits a PolicyResult. |
|
Package evidencetypes holds the in-tree evidence-type schemas (JSON Schema documents) and exposes the loader that registers them into the orchestrator's EvidenceType registry at bootstrap.
|
Package evidencetypes holds the in-tree evidence-type schemas (JSON Schema documents) and exposes the loader that registers them into the orchestrator's EvidenceType registry at bootstrap. |
|
Package fixturehygiene hosts the automated test for the WU-0.3 secret/PII fixture gate.
|
Package fixturehygiene hosts the automated test for the WU-0.3 secret/PII fixture gate. |
|
Package frameworks holds the process-global registry of compliance framework factories.
|
Package frameworks holds the process-global registry of compliance framework factories. |
|
builtin
Package builtin imports every in-tree framework for the side effect of running its init() — which registers a Factory with the frameworks registry.
|
Package builtin imports every in-tree framework for the side effect of running its init() — which registers a Factory with the frameworks registry. |
|
iso27001
Package iso27001 is the ISO/IEC 27001:2022 framework: the Annex A control catalog, the automated technological-control policies in the pass_when: DSL, and the manual-evidence policies across the organizational, people, physical, and technological themes.
|
Package iso27001 is the ISO/IEC 27001:2022 framework: the Annex A control catalog, the automated technological-control policies in the pass_when: DSL, and the manual-evidence policies across the organizational, people, physical, and technological themes. |
|
soc2
Package soc2 is the SOC 2 (TSC 2017) framework: the control catalog, the automated policy library expressed in the pass_when: DSL, and the manual-evidence policies.
|
Package soc2 is the SOC 2 (TSC 2017) framework: the control catalog, the automated policy library expressed in the pass_when: DSL, and the manual-evidence policies. |
|
Package log is the cross-cutting redaction logger.
|
Package log is the cross-cutting redaction logger. |
|
Package manualcatalog defines the descriptive, presentation-facing manual-evidence catalog that `sigcomply evidence catalog` exports as JSON.
|
Package manualcatalog defines the descriptive, presentation-facing manual-evidence catalog that `sigcomply evidence catalog` exports as JSON. |
|
Package manualdue answers one question, read-only and ahead of time: which manual-evidence entries have no file in the folder the next run will read?
|
Package manualdue answers one question, read-only and ahead of time: which manual-evidence entries have no file in the folder the next run will read? |
|
Package orchestrator is L9 of the SigComply CLI: wires L3 through L8 for the `sigcomply check` command — config load, registry init, plan, collect, evaluate, persist, aggregate, submit, render.
|
Package orchestrator is L9 of the SigComply CLI: wires L3 through L8 for the `sigcomply check` command — config load, registry init, plan, collect, evaluate, persist, aggregate, submit, render. |
|
Package planner is L3 of the SigComply CLI: reads the project config plus the selected framework plus the registries and produces a fully resolved RunPlan — slot bindings, effective parameters, resolved exceptions, derived period.
|
Package planner is L3 of the SigComply CLI: reads the project config plus the selected framework plus the registries and produces a fully resolved RunPlan — slot bindings, effective parameters, resolved exceptions, derived period. |
|
Package registry is L2 of the SigComply CLI: in-process catalogs of the things that can be referenced by ID — frameworks, source plugins, rules, evidence types, and policies.
|
Package registry is L2 of the SigComply CLI: in-process catalogs of the things that can be referenced by ID — frameworks, source plugins, rules, evidence types, and policies. |
|
Package report implements `sigcomply report`: the read-only, auditor-facing snapshot tool.
|
Package report implements `sigcomply report`: the read-only, auditor-facing snapshot tool. |
|
Package scope answers the question every other layer assumes away: did this run actually look at everything it was supposed to?
|
Package scope answers the question every other layer assumes away: did this run actually look at everything it was supposed to? |
|
Package sign is the cross-cutting signing primitive: per-file ephemeral Ed25519 keypair generation, canonical JSON encoding (RFC 8785-style), and envelope signing/verification.
|
Package sign is the cross-cutting signing primitive: per-file ephemeral Ed25519 keypair generation, canonical JSON encoding (RFC 8785-style), and envelope signing/verification. |
|
Package sources holds the process-global factory registry used to instantiate SourcePlugin values from project configuration.
|
Package sources holds the process-global factory registry used to instantiate SourcePlugin values from project configuration. |
|
activedirectory
Package activedirectory implements the active_directory source plugin: it reads user objects from an on-premises Active Directory domain over LDAPS (or LDAP + StartTLS) and emits one roster_entry per user, so a project can designate AD as its workforce roster.
|
Package activedirectory implements the active_directory source plugin: it reads user objects from an on-premises Active Directory domain over LDAPS (or LDAP + StartTLS) and emits one roster_entry per user, so a project can designate AD as its workforce roster. |
|
aws/accesskeys
Package accesskeys implements the aws.iam_access_key source plugin: lists IAM users in one AWS account, then their programmatic access keys, and emits one iam_access_key evidence record per key — suitable for SOC 2 CC6 key-hygiene policies (rotation age, unused-key detection, never-used-active keys).
|
Package accesskeys implements the aws.iam_access_key source plugin: lists IAM users in one AWS account, then their programmatic access keys, and emits one iam_access_key evidence record per key — suitable for SOC 2 CC6 key-hygiene policies (rotation age, unused-key detection, never-used-active keys). |
|
aws/acm
Package acm implements the aws.acm source plugin: lists ACM certificates and emits tls_certificate evidence records with cross-vendor expiry, managed-status, and auto-renewal attributes.
|
Package acm implements the aws.acm source plugin: lists ACM certificates and emits tls_certificate evidence records with cross-vendor expiry, managed-status, and auto-renewal attributes. |
|
aws/awscfg
Package awscfg builds the AWS SDK config for one configured source instance.
|
Package awscfg builds the AWS SDK config for one configured source instance. |
|
aws/awstest
Package awstest is the AWS test seam (WU-2.1): it builds an aws.Config whose HTTP traffic is recorded/replayed through a go-vcr cassette, so AWS source plugins can be exercised offline through the real SDK deserializer.
|
Package awstest is the AWS test seam (WU-2.1): it builds an aws.Config whose HTTP traffic is recorded/replayed through a go-vcr cassette, so AWS source plugins can be exercised offline through the real SDK deserializer. |
|
aws/backup
Package backup implements the aws.backup source plugin: lists AWS Backup plans and emits backup_plan evidence records with cross-vendor activeness and retention attributes.
|
Package backup implements the aws.backup source plugin: lists AWS Backup plans and emits backup_plan evidence records with cross-vendor activeness and retention attributes. |
|
aws/cloudtrail
Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes.
|
Package cloudtrail implements the aws.cloudtrail source plugin: lists CloudTrail trails and emits audit_log_trail evidence records with cross-vendor logging-coverage and integrity attributes. |
|
aws/cloudwatch
Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes.
|
Package cloudwatch implements the aws.cloudwatch source plugin: lists CloudWatch Logs log groups and emits log_group evidence records with cross-vendor retention and encryption attributes. |
|
aws/config
Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits config_change_tracking evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording).
|
Package config implements the aws.config source plugin: lists AWS Config configuration recorders along with their recording status, and emits config_change_tracking evidence records suitable for SOC 2 change-tracking policies (Config recorder enabled and recording). |
|
aws/dynamodb
Package dynamodb implements the aws.dynamodb source plugin: lists DynamoDB tables and emits nosql_table evidence records with cross-vendor encryption, point-in-time-recovery, and deletion-protection attributes.
|
Package dynamodb implements the aws.dynamodb source plugin: lists DynamoDB tables and emits nosql_table evidence records with cross-vendor encryption, point-in-time-recovery, and deletion-protection attributes. |
|
aws/ec2
Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes.
|
Package ec2 implements the aws.ec2 source plugin: lists EC2 instances in one AWS account and emits compute_instance evidence records carrying cross-vendor network-exposure, encryption, and monitoring attributes. |
|
aws/ecr
Package ecr implements the aws.ecr source plugin: lists ECR repositories in the private registry and emits container_registry evidence records with cross-vendor scan-on-push, public-exposure, immutability, and encryption attributes.
|
Package ecr implements the aws.ecr source plugin: lists ECR repositories in the private registry and emits container_registry evidence records with cross-vendor scan-on-push, public-exposure, immutability, and encryption attributes. |
|
aws/eks
Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume.
|
Package eks implements the aws.eks source plugin: lists EKS clusters in one AWS account and emits kubernetes_cluster evidence records carrying the secrets-envelope-encryption attributes that SOC 2 CC6.7 policies consume. |
|
aws/guardduty
Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled).
|
Package guardduty implements the aws.guardduty source plugin: lists GuardDuty detectors in one AWS account along with each detector's status, and emits threat_detection_service evidence records suitable for SOC 2 threat-detection policies (GuardDuty enabled). |
|
aws/iam
Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …).
|
Package iam implements the aws.iam source plugin: lists IAM users from one AWS account and emits user_record evidence records suitable for SOC 2 user-directory policies (MFA enforcement, inactive users, admin coverage, …). |
|
aws/identitycenter
Package identitycenter implements the aws.identity_center source plugin: lists the users of an AWS IAM Identity Center (formerly AWS SSO) identity store, traverses its permission-set assignments, and emits three cross-vendor shapes — directory_user (v1), roster_entry and iam_binding — so an estate whose human access runs through Identity Center rather than long-lived IAM users is evaluated against the same policies, with zero policy changes (Invariant #4, substitutability).
|
Package identitycenter implements the aws.identity_center source plugin: lists the users of an AWS IAM Identity Center (formerly AWS SSO) identity store, traverses its permission-set assignments, and emits three cross-vendor shapes — directory_user (v1), roster_entry and iam_binding — so an estate whose human access runs through Identity Center rather than long-lived IAM users is evaluated against the same policies, with zero policy changes (Invariant #4, substitutability). |
|
aws/inspector
Package inspector implements the aws.inspector source plugin: lists AWS Inspector2 findings and emits vulnerability_finding evidence records with cross-vendor severity, status, CVE, and remediation attributes.
|
Package inspector implements the aws.inspector source plugin: lists AWS Inspector2 findings and emits vulnerability_finding evidence records with cross-vendor severity, status, CVE, and remediation attributes. |
|
aws/kms
Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume.
|
Package kms implements the aws.kms source plugin: lists KMS keys in one AWS account and emits kms_key evidence records carrying the rotation and manager attributes that SOC 2 CC6.7 policies consume. |
|
aws/lambda
Package lambda implements the aws.lambda source plugin: lists AWS Lambda functions and emits serverless_function evidence records with cross-vendor VPC-placement, tracing, and environment-variable-encryption attributes.
|
Package lambda implements the aws.lambda source plugin: lists AWS Lambda functions and emits serverless_function evidence records with cross-vendor VPC-placement, tracing, and environment-variable-encryption attributes. |
|
aws/passwordpolicy
Package passwordpolicy implements the aws.password_policy source plugin: reads the IAM account password policy and emits a single password_policy evidence record describing minimum length, expiry, reuse prevention, and the four character-class requirements.
|
Package passwordpolicy implements the aws.password_policy source plugin: reads the IAM account password policy and emits a single password_policy evidence record describing minimum length, expiry, reuse prevention, and the four character-class requirements. |
|
aws/rds
Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes.
|
Package rds implements the aws.rds source plugin: lists RDS DB instances and emits managed_database_instance evidence records with cross-vendor encryption, access, backup, and redundancy attributes. |
|
aws/s3
Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores.
|
Package s3 implements the aws.s3 source plugin: lists S3 buckets in one AWS account and emits object_storage_bucket evidence records — the cross-vendor shape policies use across S3, GCS, Azure Blob, and S3-compatible stores. |
|
aws/secretsmanager
Package secretsmanager implements the aws.secretsmanager source plugin: lists AWS Secrets Manager secrets and emits secret evidence records with cross-vendor rotation and encryption attributes.
|
Package secretsmanager implements the aws.secretsmanager source plugin: lists AWS Secrets Manager secrets and emits secret evidence records with cross-vendor rotation and encryption attributes. |
|
aws/securityalert
Package securityalert implements the aws.security_alert source plugin.
|
Package securityalert implements the aws.security_alert source plugin. |
|
aws/securitygroups
Package securitygroups implements the aws.security_group source plugin: lists EC2 security groups in one AWS account and emits one firewall_rule evidence record per ingress/egress rule, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate.
|
Package securitygroups implements the aws.security_group source plugin: lists EC2 security groups in one AWS account and emits one firewall_rule evidence record per ingress/egress rule, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate. |
|
aws/securityservices
Package securityservices implements the aws.security_services source plugin: probes account-level enablement of AWS Macie, Inspector, and SecurityHub and emits one security_service evidence record per service.
|
Package securityservices implements the aws.security_services source plugin: probes account-level enablement of AWS Macie, Inspector, and SecurityHub and emits one security_service evidence record per service. |
|
aws/vpc
Package vpc implements the aws.vpc source plugin: lists VPCs in one AWS account and emits network evidence records carrying the cross-vendor flow-logging / default-network attributes policies check.
|
Package vpc implements the aws.vpc source plugin: lists VPCs in one AWS account and emits network evidence records carrying the cross-vendor flow-logging / default-network attributes policies check. |
|
azure/acr
Package acr implements the azure.acr source plugin: it lists Azure Container Registries in a subscription and emits one cross-vendor container_registry record per registry, so scan-on-push, public-exposure, and encryption policies evaluate against Azure exactly as they do against AWS ECR and GCP Artifact Registry — zero policy changes (Invariant #4).
|
Package acr implements the azure.acr source plugin: it lists Azure Container Registries in a subscription and emits one cross-vendor container_registry record per registry, so scan-on-push, public-exposure, and encryption policies evaluate against Azure exactly as they do against AWS ECR and GCP Artifact Registry — zero policy changes (Invariant #4). |
|
azure/aks
Package aks implements the azure.aks source plugin: it lists Azure Kubernetes Service (AKS) managed clusters in a subscription and emits one cross-vendor kubernetes_cluster record per cluster, so secrets-encryption, logging, and network-isolation policies evaluate against Azure exactly as they do against AWS EKS and GCP GKE — zero policy changes (Invariant #4).
|
Package aks implements the azure.aks source plugin: it lists Azure Kubernetes Service (AKS) managed clusters in a subscription and emits one cross-vendor kubernetes_cluster record per cluster, so secrets-encryption, logging, and network-isolation policies evaluate against Azure exactly as they do against AWS EKS and GCP GKE — zero policy changes (Invariant #4). |
|
azure/backup
Package backup implements the azure.backup source plugin: it enumerates Azure Recovery Services backup protection policies across a subscription and emits one cross-vendor backup_plan record per policy, so the backup_plan policy (soc2.a1.1.backup_plan_exists) evaluates against Azure exactly as it does against AWS Backup and GCP Backup — zero policy changes (Invariant #4).
|
Package backup implements the azure.backup source plugin: it enumerates Azure Recovery Services backup protection policies across a subscription and emits one cross-vendor backup_plan record per policy, so the backup_plan policy (soc2.a1.1.backup_plan_exists) evaluates against Azure exactly as it does against AWS Backup and GCP Backup — zero policy changes (Invariant #4). |
|
azure/certs
Package certs implements the azure.certs source plugin: it lists Azure certificates in a subscription and emits one cross-vendor tls_certificate record per certificate, so the expiry and auto-renewal policies evaluate against Azure exactly as they do against AWS ACM and GCP Certificate Manager — zero policy changes (Invariant #4, substitutability).
|
Package certs implements the azure.certs source plugin: it lists Azure certificates in a subscription and emits one cross-vendor tls_certificate record per certificate, so the expiry and auto-renewal policies evaluate against Azure exactly as they do against AWS ACM and GCP Certificate Manager — zero policy changes (Invariant #4, substitutability). |
|
azure/compute
Package compute implements the azure.compute source plugin: it lists Azure Virtual Machines in a subscription and emits one cross-vendor compute_instance record per VM, so network-exposure, encryption, and monitoring policies evaluate against Azure exactly as they do against AWS EC2 and GCP Compute Engine — zero policy changes (Invariant #4).
|
Package compute implements the azure.compute source plugin: it lists Azure Virtual Machines in a subscription and emits one cross-vendor compute_instance record per VM, so network-exposure, encryption, and monitoring policies evaluate against Azure exactly as they do against AWS EC2 and GCP Compute Engine — zero policy changes (Invariant #4). |
|
azure/cosmos
Package cosmos implements the azure.cosmos source plugin: it lists Azure Cosmos DB accounts in a subscription and emits one cross-vendor nosql_table record per account, so the encryption, point-in-time-recovery, and deletion-protection policies evaluate against Azure exactly as they do against AWS DynamoDB and GCP Firestore — zero policy changes (Invariant #4).
|
Package cosmos implements the azure.cosmos source plugin: it lists Azure Cosmos DB accounts in a subscription and emits one cross-vendor nosql_table record per account, so the encryption, point-in-time-recovery, and deletion-protection policies evaluate against Azure exactly as they do against AWS DynamoDB and GCP Firestore — zero policy changes (Invariant #4). |
|
azure/defender
Package defender implements the azure.defender source plugin: it reads Microsoft Defender for Cloud (Azure Security Center) in a subscription and emits three cross-vendor types — threat_detection_service (one per Defender plan), security_service (one CSPM record for Defender for Cloud itself), and vulnerability_finding (one per security sub-assessment) — so threat-detection, security-service-enablement, and unaddressed-finding policies evaluate against Azure exactly as they do against AWS (GuardDuty / SecurityHub-Macie-Inspector / Inspector findings) and GCP (Security Command Center) — zero policy changes (Invariant #4).
|
Package defender implements the azure.defender source plugin: it reads Microsoft Defender for Cloud (Azure Security Center) in a subscription and emits three cross-vendor types — threat_detection_service (one per Defender plan), security_service (one CSPM record for Defender for Cloud itself), and vulnerability_finding (one per security sub-assessment) — so threat-detection, security-service-enablement, and unaddressed-finding policies evaluate against Azure exactly as they do against AWS (GuardDuty / SecurityHub-Macie-Inspector / Inspector findings) and GCP (Security Command Center) — zero policy changes (Invariant #4). |
|
azure/entra
Package entra implements the azure.entra source plugin: lists Microsoft Entra ID (Azure AD) users via Microsoft Graph and emits one cross-vendor directory_user record per user, so MFA, admin, and lifecycle policies (e.g.
|
Package entra implements the azure.entra source plugin: lists Microsoft Entra ID (Azure AD) users via Microsoft Graph and emits one cross-vendor directory_user record per user, so MFA, admin, and lifecycle policies (e.g. |
|
azure/internal/azcommon
Package azcommon is the shared credential, subscription, and resource-graph foundation reused by every azure.* source plugin (WU-5.0).
|
Package azcommon is the shared credential, subscription, and resource-graph foundation reused by every azure.* source plugin (WU-5.0). |
|
azure/internal/azuretest
Package azuretest is the Azure ARM test seam (WU-2.12): it builds the arm.ClientOptions (transport + endpoint) and a fake credential that point an Azure SDK ARM client at a go-vcr cassette instead of the live management plane, so Azure source plugins run offline through the real deserializer.
|
Package azuretest is the Azure ARM test seam (WU-2.12): it builds the arm.ClientOptions (transport + endpoint) and a fake credential that point an Azure SDK ARM client at a go-vcr cassette instead of the live management plane, so Azure source plugins run offline through the real deserializer. |
|
azure/keyvault
Package keyvault implements the azure.keyvault source plugin: it reads Azure Key Vault keys and secrets in a subscription and emits two cross-vendor types — kms_key (one per key — same type as aws.kms / gcp.kms) and secret (one per secret — same type as aws.secretsmanager / gcp.secretmanager) — so the key rotation, customer-managed-key, and secret rotation/encryption policies evaluate against Azure exactly as they do against AWS and GCP, with zero policy changes (Invariant #4).
|
Package keyvault implements the azure.keyvault source plugin: it reads Azure Key Vault keys and secrets in a subscription and emits two cross-vendor types — kms_key (one per key — same type as aws.kms / gcp.kms) and secret (one per secret — same type as aws.secretsmanager / gcp.secretmanager) — so the key rotation, customer-managed-key, and secret rotation/encryption policies evaluate against Azure exactly as they do against AWS and GCP, with zero policy changes (Invariant #4). |
|
azure/monitor
Package monitor implements the azure.monitor source plugin: it reads Azure Monitor's logging surface in a subscription and emits two cross-vendor types — log_group (one per Log Analytics workspace) and audit_log_trail (one per subscription, the Activity Log) — so log-retention and audit-logging policies evaluate against Azure exactly as they do against AWS (CloudWatch Logs + CloudTrail) and GCP (log buckets + Cloud Audit Logs) — zero policy changes (Invariant #4).
|
Package monitor implements the azure.monitor source plugin: it reads Azure Monitor's logging surface in a subscription and emits two cross-vendor types — log_group (one per Log Analytics workspace) and audit_log_trail (one per subscription, the Activity Log) — so log-retention and audit-logging policies evaluate against Azure exactly as they do against AWS (CloudWatch Logs + CloudTrail) and GCP (log buckets + Cloud Audit Logs) — zero policy changes (Invariant #4). |
|
azure/network
Package network implements the azure.network source plugin: it reads Azure Network Security Groups and Virtual Networks in a subscription and emits two cross-vendor types — firewall_rule (one per NSG rule, flattened) and network (one per VNet) — so network-exposure and flow-logging policies evaluate against Azure exactly as they do against AWS (security groups + VPCs) and GCP (firewall rules + VPC networks) — zero policy changes (Invariant #4).
|
Package network implements the azure.network source plugin: it reads Azure Network Security Groups and Virtual Networks in a subscription and emits two cross-vendor types — firewall_rule (one per NSG rule, flattened) and network (one per VNet) — so network-exposure and flow-logging policies evaluate against Azure exactly as they do against AWS (security groups + VPCs) and GCP (firewall rules + VPC networks) — zero policy changes (Invariant #4). |
|
azure/policy
Package policy implements the azure.policy source plugin: it emits a single config_change_tracking evidence record describing whether an Azure subscription has resource-configuration tracking configured — the same cloud-neutral type aws.config and gcp.asset emit, so the config-recording policies (SOC2 CC7.1, ISO A.8.9) span all three clouds with zero policy changes (Invariant #4, substitutability).
|
Package policy implements the azure.policy source plugin: it emits a single config_change_tracking evidence record describing whether an Azure subscription has resource-configuration tracking configured — the same cloud-neutral type aws.config and gcp.asset emit, so the config-recording policies (SOC2 CC7.1, ISO A.8.9) span all three clouds with zero policy changes (Invariant #4, substitutability). |
|
azure/sql
Package sql implements the azure.sql source plugin: it enumerates Azure's three managed relational-database services in a subscription and emits one cross-vendor managed_database_instance record per database/server, so encryption-at-rest, public-access, backup, SSL, and multi-AZ policies evaluate against Azure exactly as they do against AWS RDS and GCP Cloud SQL — zero policy changes (Invariant #4, substitutability).
|
Package sql implements the azure.sql source plugin: it enumerates Azure's three managed relational-database services in a subscription and emits one cross-vendor managed_database_instance record per database/server, so encryption-at-rest, public-access, backup, SSL, and multi-AZ policies evaluate against Azure exactly as they do against AWS RDS and GCP Cloud SQL — zero policy changes (Invariant #4, substitutability). |
|
azure/storage
Package storage implements the azure.storage source plugin: lists every Azure Storage account in a subscription and emits one cross-vendor object_storage_bucket record per account, so encryption-at-rest, public-access, and versioning policies evaluate against Azure exactly as they do against AWS S3 and GCS — zero policy changes (Invariant #4, substitutability).
|
Package storage implements the azure.storage source plugin: lists every Azure Storage account in a subscription and emits one cross-vendor object_storage_bucket record per account, so encryption-at-rest, public-access, and versioning policies evaluate against Azure exactly as they do against AWS S3 and GCS — zero policy changes (Invariant #4, substitutability). |
|
builtin
Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry.
|
Package builtin imports every in-tree source plugin for the side effect of running its init() — which registers a factory under the sources.Register registry. |
|
gcp/artifactregistry
Package artifactregistry implements the gcp.artifactregistry source plugin: lists Artifact Registry repositories across every location in one GCP project and emits one container_registry evidence record per repository, carrying the scan-on-push, public-exposure, immutability, and encryption attributes the container-registry policies evaluate — the same cloud-neutral type aws.ecr emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
|
Package artifactregistry implements the gcp.artifactregistry source plugin: lists Artifact Registry repositories across every location in one GCP project and emits one container_registry evidence record per repository, carrying the scan-on-push, public-exposure, immutability, and encryption attributes the container-registry policies evaluate — the same cloud-neutral type aws.ecr emits, so those policies span both clouds with zero changes (Invariant #4, substitutability). |
|
gcp/asset
Package asset implements the gcp.asset source plugin: it emits a single config_change_tracking evidence record describing whether a GCP project has resource-change tracking configured — the same cloud-neutral type aws.config emits, so the config-recording policies (SOC2 CC7.1, ISO A.8.9) span both clouds with zero changes (Invariant #4, substitutability).
|
Package asset implements the gcp.asset source plugin: it emits a single config_change_tracking evidence record describing whether a GCP project has resource-change tracking configured — the same cloud-neutral type aws.config emits, so the config-recording policies (SOC2 CC7.1, ISO A.8.9) span both clouds with zero changes (Invariant #4, substitutability). |
|
gcp/audit
Package audit implements the gcp.audit source plugin: it emits a single audit_log_trail evidence record describing a GCP project's Cloud Audit Logs posture — the same cloud-neutral type aws.cloudtrail emits, so the audit-logging policies (SOC2 CC7.1, ISO A.8.15) span both clouds with zero changes (Invariant #4, substitutability).
|
Package audit implements the gcp.audit source plugin: it emits a single audit_log_trail evidence record describing a GCP project's Cloud Audit Logs posture — the same cloud-neutral type aws.cloudtrail emits, so the audit-logging policies (SOC2 CC7.1, ISO A.8.15) span both clouds with zero changes (Invariant #4, substitutability). |
|
gcp/backup
Package backup implements the gcp.backup source plugin: lists Backup and DR Service backup plans across every location in one GCP project and emits one backup_plan evidence record per plan, carrying the active / retention attributes the backup_plan policies evaluate — the same cloud-neutral type aws.backup emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
|
Package backup implements the gcp.backup source plugin: lists Backup and DR Service backup plans across every location in one GCP project and emits one backup_plan evidence record per plan, carrying the active / retention attributes the backup_plan policies evaluate — the same cloud-neutral type aws.backup emits, so those policies span both clouds with zero changes (Invariant #4, substitutability). |
|
gcp/certs
Package certs implements the gcp.certs source plugin: lists Certificate Manager certificates across every location in one GCP project and emits one tls_certificate evidence record per certificate, carrying the expiry, managed-status, and auto-renewal attributes the tls_certificate policies evaluate — the same cloud-neutral type aws.acm emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
|
Package certs implements the gcp.certs source plugin: lists Certificate Manager certificates across every location in one GCP project and emits one tls_certificate evidence record per certificate, carrying the expiry, managed-status, and auto-renewal attributes the tls_certificate policies evaluate — the same cloud-neutral type aws.acm emits, so those policies span both clouds with zero changes (Invariant #4, substitutability). |
|
gcp/compute
Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …).
|
Package compute implements the gcp.compute source plugin: lists Compute Engine VM instances across every zone in a project and emits one compute_instance evidence record per VM so SOC 2 policies can flag misconfigurations (default service account, shielded-VM off, public IP, OS-Login disabled, …). |
|
gcp/directory
Package directory implements the gcp.directory source plugin: lists Google Workspace / Cloud Identity users via the Admin SDK Directory API and emits one cross-vendor directory_user record per user so MFA, admin, and lifecycle policies (e.g.
|
Package directory implements the gcp.directory source plugin: lists Google Workspace / Cloud Identity users via the Admin SDK Directory API and emits one cross-vendor directory_user record per user so MFA, admin, and lifecycle policies (e.g. |
|
gcp/firestore
Package firestore implements the gcp.firestore source plugin: lists Cloud Firestore databases in one GCP project and emits one nosql_table evidence record per database, carrying the encryption, point-in-time- recovery, and deletion-protection attributes the nosql_table policies evaluate — the same cloud-neutral type aws.dynamodb emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
|
Package firestore implements the gcp.firestore source plugin: lists Cloud Firestore databases in one GCP project and emits one nosql_table evidence record per database, carrying the encryption, point-in-time- recovery, and deletion-protection attributes the nosql_table policies evaluate — the same cloud-neutral type aws.dynamodb emits, so those policies span both clouds with zero changes (Invariant #4, substitutability). |
|
gcp/firewall
Package firewall implements the gcp.firewall source plugin: lists VPC firewall rules in one GCP project and emits one firewall_rule evidence record per protocol/port-range within each firewall, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate — the same neutral type aws.security_group emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
|
Package firewall implements the gcp.firewall source plugin: lists VPC firewall rules in one GCP project and emits one firewall_rule evidence record per protocol/port-range within each firewall, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate — the same neutral type aws.security_group emits, so those policies span both clouds with zero changes (Invariant #4, substitutability). |
|
gcp/gcptest
Package gcptest is the GCP test seam (WU-2.7): it builds the option.ClientOption set that points a GCP SDK client (google.golang.org/api/* or cloud.google.com/go/storage) at a go-vcr cassette instead of the live API, so GCP source plugins can be exercised offline through the real deserializer.
|
Package gcptest is the GCP test seam (WU-2.7): it builds the option.ClientOption set that points a GCP SDK client (google.golang.org/api/* or cloud.google.com/go/storage) at a go-vcr cassette instead of the live API, so GCP source plugins can be exercised offline through the real deserializer. |
|
gcp/gke
Package gke implements the gcp.gke source plugin: lists GKE (Google Kubernetes Engine) clusters across every location in one GCP project and emits one kubernetes_cluster evidence record per cluster, carrying the secrets-encryption, logging, and network-isolation attributes the kubernetes_cluster policies evaluate — the same cloud-neutral type aws.eks emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
|
Package gke implements the gcp.gke source plugin: lists GKE (Google Kubernetes Engine) clusters across every location in one GCP project and emits one kubernetes_cluster evidence record per cluster, carrying the secrets-encryption, logging, and network-isolation attributes the kubernetes_cluster policies evaluate — the same cloud-neutral type aws.eks emits, so those policies span both clouds with zero changes (Invariant #4, substitutability). |
|
gcp/iam
Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users.
|
Package iam implements the gcp.iam source plugin: fetches the project-level IAM policy from Cloud Resource Manager and emits one iam_binding evidence record per (role, principal) pair so SOC 2 least-privilege policies can flag (e.g.) `roles/owner` granted to individual users. |
|
gcp/kms
Package kms implements the gcp.kms source plugin: lists Cloud KMS crypto keys across every location in one GCP project and emits one kms_key evidence record per key, carrying the rotation and manager attributes key-rotation policies evaluate — the same neutral type aws.kms emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
|
Package kms implements the gcp.kms source plugin: lists Cloud KMS crypto keys across every location in one GCP project and emits one kms_key evidence record per key, carrying the rotation and manager attributes key-rotation policies evaluate — the same neutral type aws.kms emits, so those policies span both clouds with zero changes (Invariant #4, substitutability). |
|
gcp/logging
Package logging implements the gcp.logging source plugin: lists Cloud Logging log buckets in one GCP project and emits one log_group evidence record per bucket, carrying the retention and encryption attributes the log-retention and log-encryption policies evaluate — the same cloud-neutral type aws.cloudwatch emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
|
Package logging implements the gcp.logging source plugin: lists Cloud Logging log buckets in one GCP project and emits one log_group evidence record per bucket, carrying the retention and encryption attributes the log-retention and log-encryption policies evaluate — the same cloud-neutral type aws.cloudwatch emits, so those policies span both clouds with zero changes (Invariant #4, substitutability). |
|
gcp/network
Package network implements the gcp.network source plugin: lists VPC Networks in one GCP project and emits one network evidence record per VPC, carrying the cross-vendor flow-logging / default-network attributes policies evaluate — the same neutral type aws.vpc emits, so flow-log and default-VPC-removal policies span both clouds with zero changes (Invariant #4, substitutability).
|
Package network implements the gcp.network source plugin: lists VPC Networks in one GCP project and emits one network evidence record per VPC, carrying the cross-vendor flow-logging / default-network attributes policies evaluate — the same neutral type aws.vpc emits, so flow-log and default-VPC-removal policies span both clouds with zero changes (Invariant #4, substitutability). |
|
gcp/scc
Package scc implements the gcp.scc source plugin: it reads Google Security Command Center (SCC) and emits three cross-vendor evidence types so SCC-backed GCP customers satisfy the same controls as AWS customers with zero policy changes (Invariant #4, substitutability):
|
Package scc implements the gcp.scc source plugin: it reads Google Security Command Center (SCC) and emits three cross-vendor evidence types so SCC-backed GCP customers satisfy the same controls as AWS customers with zero policy changes (Invariant #4, substitutability): |
|
gcp/secretmanager
Package secretmanager implements the gcp.secretmanager source plugin: lists Secret Manager secrets in one GCP project and emits one secret evidence record per secret, carrying the rotation and encryption attributes the secrets-rotation and secrets-encryption policies evaluate — the same cloud-neutral type aws.secretsmanager emits, so those policies span both clouds with zero changes (Invariant #4, substitutability).
|
Package secretmanager implements the gcp.secretmanager source plugin: lists Secret Manager secrets in one GCP project and emits one secret evidence record per secret, carrying the rotation and encryption attributes the secrets-rotation and secrets-encryption policies evaluate — the same cloud-neutral type aws.secretsmanager emits, so those policies span both clouds with zero changes (Invariant #4, substitutability). |
|
gcp/sql
Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
|
Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc. |
|
gcp/storage
Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration.
|
Package storage implements the gcp.storage source plugin: lists all GCS buckets in a project and emits a gcs_bucket evidence record per bucket so SOC 2 storage-hardening policies (uniform-bucket-level access, versioning, retention, public access prevention) can check configuration. |
|
github
Package github implements the github source plugin: it reads a single GitHub organization and emits six cloud-neutral evidence types — git_repository, directory_user, source_control_org_policy, vulnerability_finding, pull_request and deployment — suitable for SOC 2 branch-protection, 2FA-coverage and change-management policies.
|
Package github implements the github source plugin: it reads a single GitHub organization and emits six cloud-neutral evidence types — git_repository, directory_user, source_control_org_policy, vulnerability_finding, pull_request and deployment — suitable for SOC 2 branch-protection, 2FA-coverage and change-management policies. |
|
gitlab
Package gitlab implements the gitlab source plugin: lists projects ("repositories") and members under a single GitLab group and emits the cross-vendor git_repository and directory_user evidence types — suitable for SOC 2 / ISO 27001 branch-protection, code-review, and identity (MFA/admin/lifecycle) policies.
|
Package gitlab implements the gitlab source plugin: lists projects ("repositories") and members under a single GitLab group and emits the cross-vendor git_repository and directory_user evidence types — suitable for SOC 2 / ISO 27001 branch-protection, code-review, and identity (MFA/admin/lifecycle) policies. |
|
manual
Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry.
|
Package manual implements the manual.pdf source plugin: a project- level singleton that reads customer-uploaded evidence files from the project's configured manual-evidence backend and emits a single signed_document manifest record per catalog entry. |
|
manual/azureblob
Package azureblob implements the manual.pdf Reader on Azure Blob Storage.
|
Package azureblob implements the manual.pdf Reader on Azure Blob Storage. |
|
manual/builtin
Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry.
|
Package builtin imports every in-tree manual.pdf reader backend for the side effect of running its init() — which registers a ReaderFactory under the manual.RegisterReader registry. |
|
manual/fileconv
Package fileconv converts common image formats to PDF bytes.
|
Package fileconv converts common image formats to PDF bytes. |
|
manual/gcs
Package gcs implements the manual.pdf Reader on Google Cloud Storage.
|
Package gcs implements the manual.pdf Reader on Google Cloud Storage. |
|
manual/pdfmerge
Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu.
|
Package pdfmerge merges one or more in-memory PDFs into a single PDF using pdfcpu. |
|
manual/s3
Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
|
Package s3 implements the manual.pdf Reader on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle). |
|
okta
Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits three evidence types — directory_user and okta_app (SOC 2 MFA coverage policies) and roster_entry (Okta as the organization's authoritative workforce roster, including deprovisioned users).
|
Package okta implements the okta source plugin: lists users and applications from a single Okta organization and emits three evidence types — directory_user and okta_app (SOC 2 MFA coverage policies) and roster_entry (Okta as the organization's authoritative workforce roster, including deprovisioned users). |
|
sourcetest
Package sourcetest is the shared test harness every source plugin's tests run through, so adding a plugin never means re-inventing test scaffolding.
|
Package sourcetest is the shared test harness every source plugin's tests run through, so adding a plugin never means re-inventing test scaffolding. |
|
Package spec is L0 of the SigComply CLI: parsers and validators for the declarative artifacts that drive the engine — framework specs, policy specs, evidence type schemas, source plugin manifests, the project config (.sigcomply.yaml), and the manual evidence catalog.
|
Package spec is L0 of the SigComply CLI: parsers and validators for the declarative artifacts that drive the engine — framework specs, policy specs, evidence type schemas, source plugin manifests, the project config (.sigcomply.yaml), and the manual evidence catalog. |
|
Package submitter is L8 of the SigComply CLI: optional cloud submission.
|
Package submitter is L8 of the SigComply CLI: optional cloud submission. |
|
Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results, attachments, and run manifests to the customer's storage backend.
|
Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results, attachments, and run manifests to the customer's storage backend. |
|
azureblob
Package azureblob implements core.Vault on Azure Blob Storage.
|
Package azureblob implements core.Vault on Azure Blob Storage. |
|
builtin
Package builtin imports every in-tree vault backend for the side effect of running its init() — which registers a Factory under the vault.RegisterBackend registry.
|
Package builtin imports every in-tree vault backend for the side effect of running its init() — which registers a Factory under the vault.RegisterBackend registry. |
|
gcs
Package gcs implements core.Vault on Google Cloud Storage.
|
Package gcs implements core.Vault on Google Cloud Storage. |
|
local
Package local implements core.Vault on the local filesystem.
|
Package local implements core.Vault on the local filesystem. |
|
s3
Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
|
Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle). |
|
vaulttest
Package vaulttest provides a backend-agnostic test suite for the core.Vault interface.
|
Package vaulttest provides a backend-agnostic test suite for the core.Vault interface. |
|
Package vendorfanout resolves a framework's fan-out catalog entries against the project's third-party register.
|
Package vendorfanout resolves a framework's fan-out catalog entries against the project's third-party register. |
Click to show internal directories.
Click to hide internal directories.