Compliance-scanning provider plugins for the complyctl CLI. Each provider implements the complyctl gRPC plugin interface (hashicorp/go-plugin) with three RPCs: Describe, Generate, and Scan.
| Provider | Binary | Description |
|---|---|---|
| openscap-provider | complyctl-provider-openscap |
XCCDF-based system compliance scanning using OpenSCAP |
| ampel-provider | complyctl-provider-ampel |
In-toto attestation-based policy verification using AMPEL and snappy |
| opa-provider | complyctl-provider-opa |
OPA/conftest-based configuration policy evaluation |
Requires Go 1.26 or higher.
make build # Build all provider binaries to bin/
make build-openscap-provider # Build openscap provider only
make build-ampel-provider # Build ampel provider only
make build-opa-provider # Build opa provider onlyBinaries are output to bin/.
Copy the built binary to the complyctl providers directory:
mkdir -p ~/.local/share/complytime/providers
cp bin/complyctl-provider-* ~/.local/share/complytime/providers/Providers are discovered automatically by complyctl using the complyctl-provider- naming convention.
make test # Run all unit tests
make lint # Run golangci-lintcmd/
├── openscap-provider/ # XCCDF-based system scanning
├── ampel-provider/ # In-toto attestation verification
└── opa-provider/ # OPA/conftest policy evaluation
internal/
├── archive/ # Shared tar.gz extraction with security constraints
└── complytime/testdata/ # Shared XML test fixtures
docs/ # Documentation
Each provider is self-contained under cmd/<name>-provider/ with its own subpackage hierarchy. Shared utilities live in internal/: internal/archive/ provides secure archive extraction for complypack content, and internal/version/ provides build-time version injection.
- Provider Development Guide -- developing providers.
- Dev Testing Environment -- devcontainer setup for interactive testing during PR review.
Apache-2.0. See LICENSE for details.
See CONTRIBUTING.md for guidelines. All changes require a feature branch and PR with review from at least two maintainers.