Feat/compliance posture

.vscode/settings.json

@@ -11,6 +11,7 @@
         "epss",
         "ghinstallation",
         "gorm",
+        "Grundschutz",
         "Kyverno",
         "libc",
         "montree",

LICENSE.txt

@@ -1,4 +1,4 @@
-Files: * except 'images/*' and except where noted otherwise
+Files: * except 'images/*', except 'vulndb/compliance/SCF.json', except 'vulndb/compliance/Grundschutz++-catalog.json' and except where noted otherwise
 Notice: The sponsors names and logos (images) are maybe subject to copyright restrictions. The 'l3montree' word mark and the 'l3montree' logo are registered trademarks. Any unpermitted usage is prohibited.
 Copyright: Copyright (c) 2024 l3montree GmbH
 License: AGPL-3.0

cmd/devguard-cli/commands/hash_migration.go

@@ -23,6 +23,7 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/l3montree-dev/devguard/accesscontrol"
 	"github.com/l3montree-dev/devguard/cmd/devguard-cli/hashmigrations"
+	"github.com/l3montree-dev/devguard/compliance"
 	"github.com/l3montree-dev/devguard/controllers"
 	"github.com/l3montree-dev/devguard/daemons"
 	"github.com/l3montree-dev/devguard/database"
@@ -92,6 +93,14 @@ func runMigrations() error {
 			}
 
 			slog.Info("hash migration check completed", "duration", time.Since(start))
+
+			db := database.NewGormDB(pool)
+			slog.Info("loading compliance controls into database...")
+			if err := compliance.LoadControlsIntoDB(db); err != nil {
+				slog.Error("failed to load compliance controls", "err", err)
+				migrationErr = err
+				return
+			}
 		}),
 	)
 

cmd/devguard/main.go

@@ -156,6 +156,7 @@ func main() {
 		fx.Invoke(func(FalsePositiveRuleRouter router.VEXRuleRouter) {}),
 		fx.Invoke(func(ExternalReferenceRouter router.ExternalReferenceRouter) {}),
 		fx.Invoke(func(CrowdsourcedVexingRouter router.CrowdsourcedVexingRouter) {}),
+		fx.Invoke(func(CompliancePostureRouter router.CompliancePostureRouter) {}),
 		fx.Invoke(func(lc fx.Lifecycle, encryptionService shared.DBEncryptionService) {
 			lc.Append(fx.Hook{
 				OnStart: func(ctx context.Context) error {

compliance/Grundschutz++_License.md

@@ -0,0 +1,11 @@
+# Legal Notice for DevGuard Users
+
+DevGuard includes control data derived from the "Stand der Technik Bibliothek" (Grundschutz++), created and maintained by the Bundesamt für Sicherheit in der Informationstechnik (BSI). This content is used here to power DevGuard's compliance posture features.
+
+This content is **not** covered by DevGuard's own AGPL license. It remains licensed separately by the BSI under the Creative Commons Attribution-ShareAlike 4.0 International License (CC BY-SA 4.0), and that license continues to apply in full to this content as distributed with DevGuard. Under the ShareAlike term, any distribution of this content (including modified versions) must remain under CC BY-SA 4.0 or a compatible license.
+
+Attribution: Control content is based on the "Stand der Technik Bibliothek" by the Bundesamt für Sicherheit in der Informationstechnik (BSI).
+
+- Source: https://github.com/BSI-Bund/Stand-der-Technik-Bibliothek
+- License: https://github.com/BSI-Bund/Stand-der-Technik-Bibliothek/blob/main/LICENSE
+- License text: https://creativecommons.org/licenses/by-sa/4.0/legalcode