Help us shape the future of Go! Take the 2026 Go Developer Survey

audit

package
v0.16.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 12, 2026 License: BSD-2-Clause Imports: 5 Imported by: 0

Documentation

Index

Constants

View Source
const (
	StatusOpen       = "open"
	StatusInProgress = "in_progress"
	StatusResolved   = "resolved"
	StatusAccepted   = "accepted" // risk accepted, will not fix
)

Finding status constants.

Variables

This section is empty.

Functions

This section is empty.

Types

type Audit

type Audit struct {
	ID        string `yaml:"id"`
	Title     string `yaml:"title"`
	Date      string `yaml:"date"`
	Assurance string `yaml:"assurance"`
	Scope     string `yaml:"scope"`
	Method    string `yaml:"method"`
}

type AuditFile

type AuditFile struct {
	Audit    Audit     `yaml:"audit"`
	Findings []Finding `yaml:"findings"`
}

type AuditSet

type AuditSet struct {
	Files             []LoadedFile
	FindingsByID      map[string]*FindingRef
	FindingsByControl map[string][]*FindingRef
}

func Load

func Load(auditsDir string) (*AuditSet, error)

Load reads real audits from auditsDir.

func LoadDirs added in v0.16.0

func LoadDirs(auditsDir, assessmentsDir string) (*AuditSet, error)

LoadDirs reads real audits from auditsDir and internal self-assessments from assessmentsDir (skipped when empty or absent), tagging each file with its Kind. Finding IDs must be unique across both.

In either directory a findings file is a "*.yaml" directly in the directory, or the "audit.yaml" of a per-cycle subdirectory ("<dir>/<cycle>/audit.yaml"). Other files in a cycle directory, such as "soa.yaml" and "references/", are not findings files and are ignored here.

func (*AuditSet) AuditsOnly added in v0.16.0

func (set *AuditSet) AuditsOnly() *AuditSet

AuditsOnly returns a view of the set restricted to real audits, with every internal assessment removed. Anything that renders for a public audience must go through it, so assessments cannot leak by omission.

type Evidence

type Evidence struct {
	Type        string `yaml:"type"`
	Ref         string `yaml:"ref"`
	Description string `yaml:"description"`
	CollectedAt string `yaml:"collected_at,omitempty"`
}

type Finding

type Finding struct {
	ID            string                     `yaml:"id"`
	Title         string                     `yaml:"title"`
	Severity      string                     `yaml:"severity"`
	Status        string                     `yaml:"status"`
	Owner         string                     `yaml:"owner"`
	Controls      []string                   `yaml:"controls"`
	Description   string                     `yaml:"description"`
	EUDIReqs      []string                   `yaml:"eudi_reqs,omitempty"`
	AnnexA        []string                   `yaml:"annex_a,omitempty"`
	GDPRItems     []string                   `yaml:"gdpr_items,omitempty"`
	ASVSSections  []string                   `yaml:"asvs_sections,omitempty"`
	FrameworkRefs map[string][]string        `yaml:"framework_refs,omitempty"` // framework ID -> requirement IDs (generic)
	TrackingIssue *IssueRef                  `yaml:"tracking_issue,omitempty"`
	Issues        []IssueRef                 `yaml:"issues,omitempty"`
	PullRequests  []IssueRef                 `yaml:"pull_requests,omitempty"`
	Evidence      []Evidence                 `yaml:"evidence,omitempty"`
	ResolvedDate  string                     `yaml:"resolved_date,omitempty"`
	Profiles      map[string]ProfileOverride `yaml:"profiles,omitempty"`
}

func (*Finding) AddEvidence

func (f *Finding) AddEvidence(ev Evidence)

func (*Finding) EvidenceForProfile added in v0.11.0

func (f *Finding) EvidenceForProfile(profile string) []Evidence

EvidenceForProfile returns the combined evidence for the given profile: the base evidence plus any profile-specific evidence.

func (*Finding) HasEvidence

func (f *Finding) HasEvidence() bool

func (*Finding) IsActive added in v0.3.1

func (f *Finding) IsActive() bool

IsActive reports whether the finding is actively being worked on.

func (*Finding) IsResolved

func (f *Finding) IsResolved() bool

func (*Finding) IsResolvedForProfile added in v0.11.0

func (f *Finding) IsResolvedForProfile(profile string) bool

IsResolvedForProfile reports whether the finding is resolved in the given profile.

func (*Finding) IsTerminal added in v0.3.1

func (f *Finding) IsTerminal() bool

IsTerminal reports whether the finding status represents a final state.

func (*Finding) IsTerminalForProfile added in v0.11.0

func (f *Finding) IsTerminalForProfile(profile string) bool

IsTerminalForProfile reports whether the finding is in a terminal state for the profile.

func (*Finding) MatchesReq added in v0.4.0

func (f *Finding) MatchesReq(fwID, reqID string) bool

MatchesReq reports whether the finding references the given requirement in the specified framework. Checks both the generic FrameworkRefs map and the legacy per-framework fields for backward compatibility.

func (*Finding) SeverityForProfile added in v0.11.0

func (f *Finding) SeverityForProfile(profile string) string

SeverityForProfile returns the effective severity for the given profile.

func (*Finding) StatusForProfile added in v0.11.0

func (f *Finding) StatusForProfile(profile string) string

StatusForProfile returns the effective status for the given profile. An empty profile name returns the default (top-level) status.

type FindingRef

type FindingRef struct {
	File    *LoadedFile
	Index   int
	Finding *Finding
}

type IssueRef

type IssueRef struct {
	Repo   string `yaml:"repo"`
	Number int    `yaml:"number"`
}

type Kind added in v0.16.0

type Kind string

Kind says whether a findings file records a real audit or an internal self-assessment. Only the former may ever be shown publicly.

const (
	// KindAudit is a real audit cycle (certification or surveillance audit).
	KindAudit Kind = "audit"
	// KindAssessment is an internal self-assessment, never public.
	KindAssessment Kind = "assessment"
)

type LoadedFile

type LoadedFile struct {
	Path string
	Kind Kind
	Data AuditFile
}

func (*LoadedFile) Save

func (lf *LoadedFile) Save() error

type ProfileOverride added in v0.11.0

type ProfileOverride struct {
	Status       string     `yaml:"status,omitempty"`
	Severity     string     `yaml:"severity,omitempty"`
	Evidence     []Evidence `yaml:"evidence,omitempty"`
	ResolvedDate string     `yaml:"resolved_date,omitempty"`
}

ProfileOverride holds per-profile status and evidence overrides for a finding.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL