README
¶
sigcomply
Zero-trust, non-custodial compliance engine — "Evidence without Access."
The sigcomply CLI runs locally in your CI/CD and turns infrastructure state
into signed compliance evidence — without giving any third party access to
your data, credentials, or production environment. Raw evidence stays in
your own storage; only aggregated counts and pass/fail scores are submitted
to the optional Compliance Dashboard.
Currently ships SOC 2 (Type II) policies; ISO 27001 is in early development. Policies are open OPA/Rego — inspect, fork, and contribute.
Install
go install github.com/SigComply/sigcomply-cli@latest
Pre-built binaries are published with each release on GitHub.
Quick start
sigcomply check --framework soc2
Auto-detects collectors based on available credentials (AWS_*,
GITHUB_TOKEN, GCP ADC, …), evaluates the framework's policies locally,
writes signed EvidenceEnvelope files to your storage backend, and (in
CI with OIDC) submits aggregated results to the SigComply Cloud API.
Manual evidence
For evidence that isn't an API call (declarations, training certificates,
HR exports), the CLI looks for a single PDF at
{framework}/{evidence_id}/{period}/evidence.pdf in your storage:
sigcomply evidence catalog # list manual entries
sigcomply evidence init # scaffold the period folders
sigcomply evidence path security_awareness_training # print where to upload a PDF
Set the framework via SIGCOMPLY_FRAMEWORK or framework: in your config file
(default: soc2). The evidence subcommands take no --framework flag.
The optional Evidence SPA is a standalone helper that generates PDFs for declaration- and checklist-style entries — the CLI never talks to it. For all other manual evidence (HR exports, training certificates, scanned documents) you produce the PDF yourself and upload it to the same path.
CI/CD
Reusable workflow / CI component:
# GitHub Actions
jobs:
compliance:
permissions: { id-token: write, contents: read }
uses: SigComply/sigcomply-cli/.github/workflows/compliance.yml@v1
with: { framework: soc2 }
# GitLab CI
include:
- component: gitlab.com/sigcomply/sigcomply-cli/compliance@v1
inputs: { framework: soc2 }
Documentation
- ARCHITECTURE.md — system design, evidence flows, signing
- docs/configuration.md — config file, env vars, flags
- CLAUDE.md — context for AI coding assistants
License
Apache-2.0 — see LICENSE.
Documentation
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
sigcomply
Package cmd is the CLI entry.
|
Package cmd is the CLI entry. |
|
internal
|
|
|
aggregator
Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []PolicyResult into the structurally counts-only SubmissionPayload that the cloud submitter consumes.
|
Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []PolicyResult into the structurally counts-only SubmissionPayload that the cloud submitter consumes. |
|
collector
Package collector is L4 of the SigComply CLI: executes per-policy source fetches, validates records against their evidence type schemas, and writes one signed envelope per (slot, source) pair via the vault.
|
Package collector is L4 of the SigComply CLI: executes per-policy source fetches, validates records against their evidence type schemas, and writes one signed envelope per (slot, source) pair via the vault. |
|
core
Package core is L1 of the SigComply CLI: the frozen Go interfaces and structs that every higher layer depends on.
|
Package core is L1 of the SigComply CLI: the frozen Go interfaces and structs that every higher layer depends on. |
|
evaluator
Package evaluator is L5 of the SigComply CLI: runs each policy's rule against the records collected for it and emits a PolicyResult.
|
Package evaluator is L5 of the SigComply CLI: runs each policy's rule against the records collected for it and emits a PolicyResult. |
|
log
Package log is the cross-cutting redaction logger.
|
Package log is the cross-cutting redaction logger. |
|
orchestrator
Package orchestrator is L9 of the SigComply CLI: wires L3 through L8 for the `sigcomply check` command — config load, registry init, plan, collect, evaluate, persist, aggregate, submit, render.
|
Package orchestrator is L9 of the SigComply CLI: wires L3 through L8 for the `sigcomply check` command — config load, registry init, plan, collect, evaluate, persist, aggregate, submit, render. |
|
planner
Package planner is L3 of the SigComply CLI: reads the project config plus the selected framework plus the registries and produces a fully resolved RunPlan — slot bindings, effective parameters, resolved exceptions, derived period.
|
Package planner is L3 of the SigComply CLI: reads the project config plus the selected framework plus the registries and produces a fully resolved RunPlan — slot bindings, effective parameters, resolved exceptions, derived period. |
|
registry
Package registry is L2 of the SigComply CLI: in-process catalogs of the things that can be referenced by ID — frameworks, source plugins, rules, evidence types, and policies.
|
Package registry is L2 of the SigComply CLI: in-process catalogs of the things that can be referenced by ID — frameworks, source plugins, rules, evidence types, and policies. |
|
sign
Package sign is the cross-cutting signing primitive: per-file ephemeral Ed25519 keypair generation, canonical JSON encoding (RFC 8785-style), and envelope signing/verification.
|
Package sign is the cross-cutting signing primitive: per-file ephemeral Ed25519 keypair generation, canonical JSON encoding (RFC 8785-style), and envelope signing/verification. |
|
spec
Package spec is L0 of the SigComply CLI: parsers and validators for the declarative artifacts that drive the engine — framework specs, policy specs, evidence type schemas, source plugin manifests, the project config (.sigcomply.yaml), and the manual evidence catalog.
|
Package spec is L0 of the SigComply CLI: parsers and validators for the declarative artifacts that drive the engine — framework specs, policy specs, evidence type schemas, source plugin manifests, the project config (.sigcomply.yaml), and the manual evidence catalog. |
|
submitter
Package submitter is L8 of the SigComply CLI: optional cloud submission.
|
Package submitter is L8 of the SigComply CLI: optional cloud submission. |
|
vault
Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results, attachments, and run manifests to the customer's storage backend.
|
Package vault is L7 of the SigComply CLI: append-only persistence of envelopes, results, attachments, and run manifests to the customer's storage backend. |
|
vault/azureblob
Package azureblob implements core.Vault on Azure Blob Storage.
|
Package azureblob implements core.Vault on Azure Blob Storage. |
|
vault/gcs
Package gcs implements core.Vault on Google Cloud Storage.
|
Package gcs implements core.Vault on Google Cloud Storage. |
|
vault/local
Package local implements core.Vault on the local filesystem.
|
Package local implements core.Vault on the local filesystem. |
|
vault/s3
Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle).
|
Package s3 implements core.Vault on AWS S3 (and S3-compatible stores via Endpoint + ForcePathStyle). |
|
vault/vaulttest
Package vaulttest provides a backend-agnostic test suite for the core.Vault interface.
|
Package vaulttest provides a backend-agnostic test suite for the core.Vault interface. |