@sagentix-inc/evidence-collector 0.2.0 → 0.2.1

package/README.md

@@ -2,7 +2,7 @@
 
 The collector runs in the customer's own CI. It reads the customer's systems with read-only credentials, runs checks, signs what it saw with an Ed25519 key and pushes the result to sos-app at `POST /api/collect`. sos-app maps each check to NIST SP 800-53 Rev. 5 controls and FedRAMP 20x KSIs itself. The collector reads the check list in `apps/sos-app/src/data/checks/<source>.json`, so it sends only check ids sos-app knows.
 
-Version 0.2.0 has 31 sources and 2,768 checks in its catalogue (counted from `src/sources/index.ts` and the catalogues on 2026-10-20, after the Windows, JumpCloud, Iru and Defender for Endpoint sources). Most of them come from engines the customer already runs (Prowler 824, DISA STIG profiles 1,347, ScubaGoggles and ScubaGear 267); the rest are the collector's own reads of Cloudflare, the clouds, identity providers, GitHub, device managers, the Mac it runs on and, since 2026-10-18, websites by URL. The first ten sources' 134 checks alone name 80 of the 610 SP 800-53 Rev. 5 controls and enhancements sos-app tracks (58 distinct base controls, counted 2026-10-20); policies cover 20 more, and the rest are procedures a person describes.
+Version 0.2.1 has 31 sources and 2,776 checks in its catalogue (counted from `src/sources/index.ts` and the catalogues on 2026-10-27; 2,768 on 2026-10-20, after the Windows, JumpCloud, Iru and Defender for Endpoint sources). Most of them come from engines the customer already runs (Prowler 824, DISA STIG profiles 1,347, ScubaGoggles and ScubaGear 267); the rest are the collector's own reads of Cloudflare, the clouds, identity providers, GitHub, device managers, the Mac it runs on and, since 2026-10-18, websites by URL. The first ten sources' 134 checks alone name 80 of the 610 SP 800-53 Rev. 5 controls and enhancements sos-app tracks (58 distinct base controls, counted 2026-10-20); policies cover 20 more, and the rest are procedures a person describes.
 
 ## Data flow
 

package/THIRD_PARTY_NOTICES.md

@@ -1,6 +1,6 @@
 # Third-party notices
 
-The collector runs these programs as separate processes, or reads their output. It does not copy their source code. The runner image (`runner/Dockerfile`) installs them unmodified, from their publishers' package registries (PyPI, Cinc's package server) or from the release assets each project publishes on GitHub, and checks every downloaded release asset against the SHA-256 its publisher lists; the MITRE STIG profiles, whose publisher lists none, are checked against the SHA-256 of the tagged tarball pinned when they were added. sos-app's check catalogues name their checks and titles, taken from each program's own metadata at a pinned version. Each name below is used only to say where a check comes from; none of these projects endorses Sagentix.
+The collector runs these programs as separate processes, or reads their output. It does not copy their source code. The runner image (`runner/Dockerfile`) installs most of them from their publishers' package registries (PyPI, Cinc's package server) or from the release assets each project publishes on GitHub, and checks every downloaded release asset against the SHA-256 its publisher lists; the MITRE STIG profiles, whose publisher lists none, are checked against the SHA-256 of the tagged tarball pinned when they were added. Five Go programs (Trivy, Gitleaks, OpenSSF Scorecard, Open Policy Agent and Kubescape) it builds from source instead, at the tag and commit each entry names, raising only the Go modules listed in `runner/go-module-fixes.txt`; their own source code is unchanged, but their `go.mod` and `go.sum` files are not. The Kubescape regolibrary entry describes the one other change, to an input file. sos-app's check catalogues name their checks and titles, taken from each program's own metadata at a pinned version. Each name below is used only to say where a check comes from; none of these projects endorses Sagentix.
 
 ## Prowler
 

package/collector/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@sagentix-inc/evidence-collector",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "type": "module"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentix-inc/evidence-collector",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Customer-side evidence collector: reads systems read-only, runs checks, signs the results and pushes them outbound to sos-app.",
   "type": "module",
   "engines": {
@@ -22,6 +22,11 @@
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Sagentix-Advisors-Inc/sagentix-collector.git",
+    "directory": "collector"
+  },
   "publishConfig": {
     "access": "public",
     "provenance": true