C

Compliance

A suite of tools to assist with reviewing Open Source Software dependencies. (Mirrored from https://github.com/oss-review-toolkit/ort)

Compliance service enforcing rules defined in the TrustFramework - Architecture Document/Compliance Document

Landing page, ten scenarios, claims ledger and a posture mirror an assessor can check without an account. Guide: https://evidence-factory.gitlab.io/guide/

Chapter 4: a Go binary at report phase. Gaps are published and advisory, so the merge request stays green. Guide: https://evidence-factory.gitlab.io/guide/

Chapter 6: a CI component at enforce phase. A planted off-catalog include stays red: the gate stops it. Guide: https://evidence-factory.gitlab.io/guide/

Chapter 3: the driver. One tool provisions the group, assesses controls, pushes verdicts and exports OSCAL. Guide: https://evidence-factory.gitlab.io/guide/

Chapter 5: a container image at cutover phase. A planted unsigned-image gap stays red: the floor blocks it. Guide: https://evidence-factory.gitlab.io/guide/

The conformance contract for projects under gitlab-com/public-sector.

Bedrock RMF — self-hosted NIST 800-53 Rev 5 / RMF compliance management (an eMASS / Xacta alternative): control implementations to the CCI, POA&Ms, evidence, HW/SW inventory, PPSM, STIG checklists, cloud inheritance. AGPL-3.0.

CLI tool for GitLab automation: sync groups to local filesystem and audit projects against security & OpenSSF best practices with automated scoring

Renders the group README and its ten scenarios as one site. Holds no prose; edit gitlab-profile. Guide: https://evidence-factory.gitlab.io/guide/

A Python-based CLI tool designed to scan GitLab projects for compliance against the CIS GitLab Benchmark. Check out the recommendations-as-code in this repo. Read the docs for more info.

Chapter 2: the policy plane. The NIST 800-53 framework, the policy that injects the line, approval gates. Guide: https://evidence-factory.gitlab.io/guide/

Chapter 1: the governed CI/CD Catalog and evidence line, with pinned components every workload builds from. Guide: https://evidence-factory.gitlab.io/guide/

Open-source, offline-first IT operations automation platform for IT managers, system administrators, help desk teams, and cybersecurity professionals. Automates and simplifies endpoint management, service desk operations, asset and software management, compliance, security, reporting, and intelligent IT operations. Built by Enriquez Technology Solutions (ETS).

AI-powered GitLab CI Component that automates DISA ASD STIG compliance analysis reducing manual checklist completion from weeks or months to minutes using GitLab Duo agentic workflows to determine compliance with the 286 security controls.

Maintenance, asset, and configuration-change records for accredited systems. Single static binary, pure-Go SQLite, LDAP/AD auth with local break-glass accounts, hash-chained audit trail. AGPL-3.0-or-later.

Source of truth for the Compliance engine, validating certificate are conforming to rules, providing shapes, schemas and trusted sources

SharedRail is an open-source, federated payment infrastructure designed to enable secure, instant, and identity-based value transfer across currencies and borders. Built on a modular architecture with mandatory encryption, KYC, and AI-assisted human intent verification, SharedRail allows users and institutions to send and receive payments using verified email identities while maintaining full transparency, auditability, and compliance through open standards. https://roxanneardary.com/sharedrail/

Vibe Sec Ops: the methodology Foxx Cyber uses to ship software written with AI coding agents. Rulebook, machine-enforced gates, evidence, accepted-risk registers and POA&Ms. Not vibe coding.