Complyctl on ComplyTime

Overview

Mon, 13 Apr 2026 01:10:00 +0000

A lightweight compliance runtime that pulls Gemara policies from an OCI registry and executes scans via plugins.

Architecture#

┌──────────────────────────────────────────────────────────────────┐
│ Host │
│ │
│ ┌──────────────┐ complyctl get ┌───────────────────────┐ │
│ │ OCI Registry │ ◄────────────────── │ │ │
│ │ │ ───────────────────►│ complyctl CLI │ │
│ │ Gemara │ catalog + policy │ │ │
│ │ policies │ layers (YAML) │ init / get / list │ │
│ └──────────────┘ │ generate / scan │ │
│ │ doctor / providers │ │
│ │ version │ │
│ └─────┬────────┬────────┘ │
│ │ │ │
│ ┌────────────┘ │ │
│ │ │ │
│ ▼ ▼ │
│ ┌──────────────┐ ┌────────────────┐ │
│ │ Cache │ │ Providers │ │
│ │ │ │ │ │
│ │ ~/.complytime│ │ ~/.complytime/ │ │
│ │ /policies/ │ │ providers/ │ │
│ │ state.json │ │ │ │
│ │ │ │ complyctl- │ │
│ │ OCI Layout │ │ provider-* │ │
│ │ per policy │ │ │ │
│ └──────────────┘ │ gRPC: Describe │ │
│ │ Generate, Scan │ │
│ ┌──────────────┐ └────────────────┘ │
│ │ Workspace │ │
│ │ │ complytime.yaml defines: │
│ │ ./complytime │ - registry URL │
│ │ .yaml │ - policy IDs + versions │
│ │ │ - targets + variables │
│ │ ./.comply- │ │
│ │ time/scan/ │ │
│ │ (output) │ Scan output (EvaluationLog, OSCAL, │
│ └──────────────┘ SARIF, Markdown) written to workspace │
└──────────────────────────────────────────────────────────────────┘

Components:

Contributing

Mon, 13 Apr 2026 01:10:00 +0000

Thank you for your interest in contributing to complyctl! We welcome contributions from the community.

Installation

Mon, 13 Apr 2026 01:10:00 +0000

Binary#

The latest binary release can be downloaded from https://github.com/complytime/complyctl/releases/latest.

Verify the release signature:

Plugin Guide

Mon, 13 Apr 2026 01:10:00 +0000

complyctl extends to arbitrary policy engines through plugins. Each plugin is a standalone executable that communicates with the CLI via gRPC using the hashicorp/go-plugin framework.

Quick Start

Mon, 13 Apr 2026 01:10:00 +0000

Step 1: Install Complyctl#

See INSTALLATION.md.

Step 2: Install A Plugin#

Scanning providers are standalone executables placed in ~/.complytime/providers/. The filename determines the evaluator ID.

Release Process

Mon, 13 Apr 2026 01:10:00 +0000

The release process values simplicity and automation in order to provide better predictability and low cost for maintainers.

Style Guide

Mon, 13 Apr 2026 01:10:00 +0000

This style guide outlines the best practices to ensure consistency and readability across the codebase.

Testing Farm

Mon, 13 Apr 2026 01:10:00 +0000

Testing Farm is Packit’s testing system. Test execution is managed by tmt tool.

The entry of the testing farm tests is located at .packit.yaml, in the job named tests.