uacdata

Documentation

Overview

Package uacdata carries UAC's artifact definitions inside the binary.

The corpus is 1.8 MB of small YAML files that compresses to about 50 KiB, so it rides along as a single tar.gz rather than as an embedded directory tree. It is unpacked into memory at first use -- never onto disk. An acquisition tool should not scatter temporary files across the examiner's machine, and there is no reason to: the whole corpus is smaller than a single collected log file.

This archive is carved out of the full one the harness uses, not packed from the checkout a second time, so the two cannot disagree about what UAC 3.3.0 contains. Regenerate in this order:

go generate ./test/uacfull ./internal/uacdata

Index

• func Artifacts() (fs.FS, error)
• func Extract(dir string, write func(name string, data []byte) error) error
• func FS() (fs.FS, error)
• func Version() (release, commit string)

Functions

func Artifacts

func Artifacts() (fs.FS, error)

Artifacts returns just the artifact definitions, rooted so that paths read "files/system/etc.yaml" exactly as they do with a real checkout.

func Extract

func Extract(dir string, write func(name string, data []byte) error) error

Extract writes the embedded tree to dir, for operators who want the definitions on disk to read or modify.

func FS

func FS() (fs.FS, error)

FS returns the embedded UAC tree: artifacts/, config/ and profiles/, plus a VERSION file recording which UAC checkout it was built from.

func Version

func Version() (release, commit string)

Version reports the UAC release and commit the embedded corpus was built from. A collection must be traceable to the definitions that produced it.