feat: submit risk and subject template definitions

.github/workflows/build-and-upload.yml

@@ -18,11 +18,11 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Install gooci cli
-        run: go install github.com/compliance-framework/gooci@latest
+        run: go install github.com/compliance-framework/gooci@v0.0.7
       - name: Authenticate gooci cli
         run: gooci login ghcr.io --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }}
       - name: gooci Upload Version
-        run: gooci upload dist/ ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:${{github.ref_name}}
+        run: gooci upload dist/ ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:${{github.ref_name}} --annotate="org.ccf.plugin.protocol.version=2"
       - name: gooci Upload Latest
         if: "!github.event.release.prerelease"
-        run: gooci upload dist/ ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:latest
+        run: gooci upload dist/ ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:latest --annotate="org.ccf.plugin.protocol.version=2"

.gitignore

@@ -3,4 +3,5 @@ dist/
 .DS_Store
 plugin
 .env
-.envrc
+.envrc
+.config

README.md

@@ -52,10 +52,10 @@ plugins:
     #   - Relative path (treated as local filesystem)
     #   - file:///absolute/path
     #   - http(s)://... or oci://...
-    path: "file:///etc/myapp/config.yaml"
+    file_path: "file:///etc/myapp/config.yaml"
 
     # Optional: path to the attestation associated with the file.
-    # Same URI formats as `path`.
+    # Same URI formats as `file_path`.
     attestation_path: "https://attest.example.com/config.yaml.att.json"
 
     # Optional: comma-separated list of authorized signers for the attestation.
@@ -71,16 +71,49 @@ plugins:
 
 ### Path rules
 
-- `path` is **required**.
-- `path` and `attestation_path` may be:
+- `file_path` is **required**.
+- `file_path` and `attestation_path` may be:
   - Relative filesystem paths (no URI scheme).
   - `file://` URIs (local filesystem).
   - `http://`, `https://`, or `oci://` URIs.
 - Any other schemes (including `git://`) are rejected during validation.
 
-The plugin also normalizes plain filesystem paths to `file://` internally so
-they can be handled consistently.
+Absolute filesystem paths are normalized to `file://` internally. Relative
+filesystem paths are kept as relative paths.
 
+### Subject labeling
+
+When the plugin emits evidence, it labels tracked files differently depending on
+where the file is sourced from:
+
+- Local filesystem paths and `file://` URIs are labeled with:
+  - `provider=file`
+  - `type=attestation`
+  - `source=local`
+  - `host=<current host>`
+  - `file=<absolute local file path>`
+- Remote `http://`, `https://`, and `oci://` targets are labeled with:
+  - `provider=file`
+  - `type=attestation`
+  - `source=remote`
+  - `host=<remote domain>`
+  - `file=<remote path excluding the domain>`
+
+This allows the framework to resolve separate subject templates for:
+
+- Local host-backed files
+- Remote files and artifacts
+
+### HTTP example
+
+Example agent configuration using an HTTP-hosted file:
+
+```yaml
+plugins:
+  file_attestation:
+    file_path: "https://raw.githubusercontent.com/compliance-framework/plugin-local-ssh/main/README.md"
+    authorized_signers: ""
+```
 ---
 
 ## Integration testing

go.mod

@@ -1,57 +1,64 @@
 module github.com/compliance-framework/plugin-file-attestation
 
-go 1.25.4
+go 1.25.8
 
 require (
-	github.com/compliance-framework/agent v0.2.1
+	github.com/compliance-framework/agent v0.3.1
 	github.com/hashicorp/go-hclog v1.6.3
 	github.com/hashicorp/go-plugin v1.7.0
 	github.com/mitchellh/mapstructure v1.5.0
 )
 
 require (
-	github.com/OneOfOne/xxhash v1.2.8 // indirect
-	github.com/agnivade/levenshtein v1.2.0 // indirect
-	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/agnivade/levenshtein v1.2.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/compliance-framework/api v0.4.4 // indirect
-	github.com/defenseunicorns/go-oscal v0.6.3 // indirect
+	github.com/compliance-framework/api v0.13.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
+	github.com/defenseunicorns/go-oscal v0.7.0 // indirect
+	github.com/docker/docker v28.5.2+incompatible // indirect
 	github.com/fatih/color v1.18.0 // indirect
-	github.com/go-ini/ini v1.67.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-viper/mapstructure/v2 v2.3.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/hashicorp/yamux v0.1.2 // indirect
+	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
+	github.com/lestrrat-go/dsig v1.0.0 // indirect
+	github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect
+	github.com/lestrrat-go/httpcc v1.0.1 // indirect
+	github.com/lestrrat-go/httprc/v3 v3.0.4 // indirect
+	github.com/lestrrat-go/jwx/v3 v3.0.13 // indirect
+	github.com/lestrrat-go/option/v2 v2.0.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/oklog/run v1.2.0 // indirect
-	github.com/open-policy-agent/opa v1.0.0 // indirect
-	github.com/prometheus/client_golang v1.20.5 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.57.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/tchap/go-patricia/v2 v2.3.1 // indirect
+	github.com/open-policy-agent/opa v1.14.1 // indirect
+	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
+	github.com/segmentio/asm v1.2.1 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/tchap/go-patricia/v2 v2.3.3 // indirect
+	github.com/valyala/fastjson v1.6.10 // indirect
+	github.com/vektah/gqlparser/v2 v2.5.32 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/yashtewari/glob-intersection v0.2.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/otel v1.37.0 // indirect
-	go.opentelemetry.io/otel/metric v1.37.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
-	go.opentelemetry.io/otel/trace v1.37.0 // indirect
-	golang.org/x/net v0.43.0 // indirect
-	golang.org/x/sys v0.35.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1 // indirect
-	google.golang.org/grpc v1.75.0 // indirect
-	google.golang.org/protobuf v1.36.8 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	go.opentelemetry.io/otel/metric v1.42.0 // indirect
+	go.opentelemetry.io/otel/trace v1.42.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/crypto v0.48.0 // indirect
+	golang.org/x/net v0.51.0 // indirect
+	golang.org/x/oauth2 v0.35.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/tools v0.42.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/grpc v1.79.3 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )