Package: auditree-framework
auditree-frameworkTool to run compliance control checks as unit tests and build up a body of evidence.This framework gives you the tools you need to create an auditable body of evidence, and is designed to be "DevSecOps" friendly. Collection & validation of evidence is modelled as python unit tests, evidence is stored & versioned in a git repository, notifications can be configured to send to Slack, create issues, contact PagerDuty, or just write files into git. The goal is to enable the digital transformation of compliance activities, and make these everyday operational tasks for the team managing the system.InstallationPrerequisitesSupported for execution on OSX and LINUX.Supported for execution with Python 3.6 and above.If you haven't already you need to generate a new ssh key for your Github account as perthis guideCheck out the codegitclonegit@github.com:ComplianceAsCode/auditree-frameworkcdauditree-frameworkFor userspython3-mvenvvenv
.venv/bin/activate
makeinstallFor developerspython3-mvenvvenv
.venv/bin/activate
makedevelopCode style and formattingThis repository usesblackfor code formatting andflake8for code styling.  It also
usespre-commithooks that are integrated into the development process and the CI.  When
you runmake developyou are ensuring that the pre-commit hooks are installed and updated to their
latest versions for this repository.  This ensures that all delivered code has been properly formatted
and passes the linter rules.  See thepre-commit configuration filefor details onblackandflake8configurations.Sinceblackandflake8are installed as part of thepre-commithooks, runningblackandflake8manually must be done throughpre-commit.  See examples below:makecode-format
makecode-lint...will runblackandflake8on the entire repo and is equivalent to:pre-commitrunblack--all-files
pre-commitrunflake8--all-files...and when looking to limit execution to a subset of files do similar to:pre-commitrunblack--filescompliance/*
pre-commitrunflake8--filescompliance/*Unit testsTo run the frameworks test suite, use:maketestBuild DocumentationDocumentation sources live indoc-source, and are also auto-generated from the source codes doc strings. The auto-generated documentation (compliance*rst, modules.rst) is ignored by git & should not be modified directly - make changes in the python code.To build the documentation locally run:makedocsThis will update the files indocwith the latest documentation. These files should not be modified by hand.Try itSuccessfully complete the steps below and you should be able to find your local
evidence locker in your$TMPDIR/compliancefolder.  There you will find arawfolder that contains all of the raw evidence fetched by the fetchers found in thedemo/demo_examples/fetchersfolder along with areportsfolder that contains
the reports generated by the checks found in thedemo/demo_examples/checksfolder.Create an emptycredentialsfile:$touch~/.credentialsSet up your environment:cddemo
python-mvenv
../venv/bin/activate
pipinstall-rrequirements.txtRun the fetchers:compliance--fetch--evidencelocal-Cauditree_demo.json-vRun the checks:compliance--checkdemo.arboretum.accred,demo.custom.accred--evidencelocal-Cauditree_demo.json-vContributeHelp us to improve the Auditree framework. SeeCONTRIBUTING.EcosystemWe are building a set of common fetchers/checks inArboretum. If you have a library of checks, please let us know & we'll link here.We have a data gathering and reporting tool calledHarvestwhich lets you process your evidence locker and generate reports over the data held.We have a tool calledPrunewhich lets you mark evidence as no longer being collected, in a suitably tracked manner.We have a tool calledPlantwhich lets you add evidence to evidence lockers without the use of fetchers or checks.