README
¶
sigcomply
Zero-trust, non-custodial compliance engine — "Evidence without Access."
The sigcomply CLI runs locally in your CI/CD and turns infrastructure state
into signed compliance evidence — without giving any third party access to
your data, credentials, or production environment. Raw evidence stays in
your own storage; only aggregated counts and pass/fail scores are submitted
to the optional Compliance Dashboard.
Currently ships SOC 2 (Type II) policies; ISO 27001 is in early development. Policies are open OPA/Rego — inspect, fork, and contribute.
Install
go install github.com/SigComply/sigcomply-cli@latest
Pre-built binaries are published with each release on GitHub.
Quick start
sigcomply check --framework soc2
Auto-detects collectors based on available credentials (AWS_*,
GITHUB_TOKEN, GCP ADC, …), evaluates the framework's policies locally,
writes signed EvidenceEnvelope files to your storage backend, and (in
CI with OIDC) submits aggregated results to the SigComply Cloud API.
Manual evidence
For evidence that isn't an API call (declarations, training certificates,
HR exports), the CLI looks for a single PDF at
{framework}/{evidence_id}/{period}/evidence.pdf in your storage:
sigcomply evidence catalog # list manual entries
sigcomply evidence init # scaffold the period folders
sigcomply evidence path security_awareness_training # print where to upload a PDF
Set the framework via SIGCOMPLY_FRAMEWORK or framework: in your config file
(default: soc2). The evidence subcommands take no --framework flag.
The optional Evidence SPA is a standalone helper that generates PDFs for declaration- and checklist-style entries — the CLI never talks to it. For all other manual evidence (HR exports, training certificates, scanned documents) you produce the PDF yourself and upload it to the same path.
CI/CD
Reusable workflow / CI component:
# GitHub Actions
jobs:
compliance:
permissions: { id-token: write, contents: read }
uses: SigComply/sigcomply-cli/.github/workflows/compliance.yml@v1
with: { framework: soc2 }
# GitLab CI
include:
- component: gitlab.com/sigcomply/sigcomply-cli/compliance@v1
inputs: { framework: soc2 }
Documentation
- ARCHITECTURE.md — system design, evidence flows, signing
- docs/configuration.md — config file, env vars, flags
- CLAUDE.md — context for AI coding assistants
License
Apache-2.0 — see LICENSE.
Documentation
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
sigcomply
Package sigcomply provides the CLI commands for SigComply.
|
Package sigcomply provides the CLI commands for SigComply. |
|
internal
|
|
|
compliance_frameworks/engine
Package engine provides the OPA policy evaluation engine.
|
Package engine provides the OPA policy evaluation engine. |
|
compliance_frameworks/iso27001
Package iso27001 provides the ISO 27001 compliance framework implementation.
|
Package iso27001 provides the ISO 27001 compliance framework implementation. |
|
compliance_frameworks/soc2
Package soc2 provides the SOC 2 compliance framework implementation.
|
Package soc2 provides the SOC 2 compliance framework implementation. |
|
core/attestation
Package attestation provides per-file signed envelopes for compliance evidence.
|
Package attestation provides per-file signed envelopes for compliance evidence. |
|
core/cloud
Package cloud provides the SigComply Cloud API client.
|
Package cloud provides the SigComply Cloud API client. |
|
core/config
Package config provides configuration loading and validation for SigComply CLI.
|
Package config provides configuration loading and validation for SigComply CLI. |
|
core/evidence
Package evidence provides core types for compliance evidence and policy evaluation results.
|
Package evidence provides core types for compliance evidence and policy evaluation results. |
|
core/manual
Package manual provides types and logic for manual evidence collection.
|
Package manual provides types and logic for manual evidence collection. |
|
core/output
Package output provides formatters for compliance check results.
|
Package output provides formatters for compliance check results. |
|
core/storage
Package storage provides interfaces and implementations for evidence storage.
|
Package storage provides interfaces and implementations for evidence storage. |
|
data_sources/apis/aws
Package aws provides evidence collection from AWS services.
|
Package aws provides evidence collection from AWS services. |
|
data_sources/apis/gcp
Package gcp provides evidence collection from Google Cloud Platform services.
|
Package gcp provides evidence collection from Google Cloud Platform services. |
|
data_sources/apis/github
Package github provides evidence collection from GitHub.
|
Package github provides evidence collection from GitHub. |
|
data_sources/manual
Package manual reads user-supplied evidence.pdf files from storage and produces evidence items for OPA evaluation.
|
Package manual reads user-supplied evidence.pdf files from storage and produces evidence items for OPA evaluation. |