Documentation
¶
Overview ¶
Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results and run manifests to the customer's storage backend. The customer's vault, never SigComply's, receives every signed evidence envelope and every run manifest. The CLI is the writer; the customer and their auditor are the readers. SigComply Cloud never reads the vault.
Backend implementations: local, s3, gcs, azure_blob — all behind the core.Vault interface. Selection is by self-registering factory: each backend's package init() calls vault.RegisterBackend, and internal/vault/builtin blank-imports them all so cmd/sigcomply pulls in every in-tree backend with one import line. Third-party backends (SFTP, MinIO, on-prem NFS, custom object stores) follow the same pattern from a project-local plugin compiled in by `sigcomply build` (M16) — no edits to internal/vault required.
The CLI never reads from the vault during the same run.
See docs/architecture/00-three-plugin-axes.md §Axis B, docs/architecture/02-layers.md, 05-vault-layout.md, and 07-extensibility.md §Custom vault backends.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ConfigWarnings ¶ added in v0.89.0
func ConfigWarnings(cfg *spec.VaultConfig) []string
ConfigWarnings reports vault keys the configured backend does not read. The vault block is an open bag, so `bakend: s3` used to load with no word and the run wrote to the default local folder.
Warning, never error: the same tolerance the sources: block has.
func FromConfig ¶
FromConfig constructs the right backend for the given project-config vault section. The returned Vault is already Init'd and ready for Put/Get/List. The factory layer is L7's seam to L8 (Orchestrator): every other layer takes a core.Vault and doesn't care which backend is behind it.
Backend selection goes through the package-global registry: each in-tree backend registers itself via init(), and the orchestrator blank-imports internal/vault/builtin to pull them all in. Third parties add custom backends the same way — see docs/architecture/07-extensibility.md §Custom vault backends.
func IDs ¶ added in v0.20.5
func IDs() []string
IDs returns every registered backend ID in sorted order. Used to build helpful error messages when project config names an unknown backend.
func RegisterBackend ¶ added in v0.20.5
RegisterBackend adds a Factory under id. Intended for an init() call in the backend's package. Duplicate IDs panic at process start — duplicates among in-tree backends are a programming error, and a project-local backend claiming a reserved ID is a misconfiguration the build should not let through.
func RegisterBackendKeys ¶ added in v0.89.0
RegisterBackendKeys records the config keys a backend reads besides `backend`, so ConfigWarnings can name a mistyped one. Optional: a backend that registers none is never warned about, which keeps a project-local backend unaffected.
Types ¶
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package azureblob implements core.Vault on Azure Blob Storage.
|
Package azureblob implements core.Vault on Azure Blob Storage. |
|
Package builtin imports every in-tree vault backend for the side effect of running its init() — which registers a Factory under the vault.RegisterBackend registry.
|
Package builtin imports every in-tree vault backend for the side effect of running its init() — which registers a Factory under the vault.RegisterBackend registry. |
|
Package gcs implements core.Vault on Google Cloud Storage.
|
Package gcs implements core.Vault on Google Cloud Storage. |
|
Package local implements core.Vault on the local filesystem.
|
Package local implements core.Vault on the local filesystem. |
|
Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
|
Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle). |
|
Package vaulttest provides a backend-agnostic test suite for the core.Vault interface.
|
Package vaulttest provides a backend-agnostic test suite for the core.Vault interface. |