Update pandoc dockerfile and latex template and fix infinite build, fix pandoc always pull and fix strikethrough (#100, #103 and #115)

.env.example

@@ -0,0 +1 @@
+COMPLY_USE_LOCAL_PANDOC=

.gitignore

@@ -4,3 +4,5 @@ dist
 .envrc
 bindata.go
 .idea/
+
+.env

build/Dockerfile

@@ -1,29 +1,10 @@
-FROM haskell:latest
+FROM pandoc/ubuntu
 
-# based on implementation by James Gregory <james@jagregory.com>
-MAINTAINER Comply <comply@strongdm.com>
-
-# install latex packages
 RUN apt-get update -y \
-  && apt-get install -y -o Acquire::Retries=10 --no-install-recommends \
+  && DEBIAN_FRONTEND=noninteractive apt-get install -y -o Acquire::Retries=10 --no-install-recommends \
   texlive-latex-base \
-    texlive-xetex \
-    texlive-fonts-recommended \
-    latex-xcolor \
   texlive-latex-extra \
-    fontconfig \
+  texlive-plain-generic \
-    unzip \
   lmodern
 
-# will ease up the update process
-# updating this env variable will trigger the automatic build of the Docker image
-ENV PANDOC_VERSION "2.2.1"
-
-# install pandoc
-RUN cabal update && cabal install pandoc-${PANDOC_VERSION}
-
 WORKDIR /source
-
-ENTRYPOINT ["/root/.cabal/bin/pandoc"]
-
-CMD ["--help"]

comply.go

@@ -1,7 +1,17 @@
 package main
 
-import "github.com/strongdm/comply/internal/cli"
+import (
+	"fmt"
+	"path/filepath"
+	"runtime"
+
+	"github.com/joho/godotenv"
+	"github.com/strongdm/comply/internal/cli"
+)
 
 func main() {
+	_, b, _, _ := runtime.Caller(0)
+	basepath := filepath.Dir(b)
+	godotenv.Load(fmt.Sprintf("%s/.env", basepath))
 	cli.Main()
 }

fixtures/narratives/invalid-control.md

@@ -0,0 +1,94 @@
+name: Control Environment Narrative
+acronym: CEN
+satisfies:
+  TSC:
+- CC2.1
+    - CC2.2
+    - CC2.3
+    - CC4.1
+    - CC4.2
+    - CC5.1
+    - CC5.2
+    - CC5.3
+majorRevisions:
+  - date: Jun 1 2018
+    comment: Initial document
+---
+
+# Control Environment Narrative
+
+The following provides a description of the control structure of {{.Name}}.
+
+The intent of this description is to enumerate the logical, policy, and procedural controls that serve to monitor {{.Name}}'s application and data security. Changes uncovered by these procedures in the logical, policy, procedural, or customer environment are addressed by remediations specific to the noted change.
+
+# Logical Controls
+
+{{.Name}} employs several logical controls to protect confidential data and ensure normal operation of its core product.
+
+- Mandatory data encryption at rest and in motion
+- Multi-factor authentication for access to cloud infrastructure
+- Activity and anomaly monitoring on production systems
+- Vulnerability management program
+
+# Policy Controls
+
+{{.Name}} employs several policy controls to protect confidential data and ensure normal operation of its core product. These policies include, but are not limited to:
+
+- Access Control Policy
+- Encryption Policy
+- Office Security Policy
+- Password Policy
+- Policy Training Policy
+- Vendor Policy
+- Workstation Policy
+
+# Procedural Controls
+
+{{.Name}} has numerous scheduled procedures to monitor and tune the effectiveness of ongoing security controls, and a series of event-driven procedures to respond to security-related events.
+
+TODO: Finalize these lists
+
+## Scheduled Security and Audit Procedures
+
+- Review Access [quarterly]
+- Review Security Logs [weekly]
+- Review Cyber Risk Assessment (enumerate possible compromise scenarios) [quarterly]
+- Review Data Classification [quarterly]
+- Backup Testing [quarterly]
+- Disaster Recovery Testing [semi-annual]
+- Review Devices & Workstations [quarterly]
+- Review & Clear Low-Priority Alerts [weekly]
+- Apply OS Patches [monthly]
+- Verify Data Disposal per Retention Policy [quarterly]
+- Conduct Security Training [annual]
+- Review Security Monitoring and Alerting Configuration [quarterly]
+- Penetration Test [annual]
+- Whitebox Security Review [annual]
+- SOC2 Audit [annual]
+
+## Event-Driven Security and Audit Procedures
+
+- Onboard Employee
+- Offboard Employee
+- Investigate Security Alert
+- Investigate Security Incident
+
+# Remediations
+
+{{.Name}} uses the outcomes of the aforementioned controls and procedures to identify shortcomings in the existing control environment. Once identified, these shortcomes are remediated by improving existing controls and procedures, and creating new controls and procedures as needed.
+
+# Communications
+
+{{.Name}} communicates relevant information regarding the functioning of the above controls with internal and external parties on an as-needed basis and according to statutory requirements.
+
+## Internal
+
+{{.Name}} communicates control outcomes, anomalies, and remediations internally using the following channels:
+
+- Slack
+- Email
+- Github ticketing
+
+## External
+
+{{.Name}} communicates relevant control-related information to external parties including shareholders, customers, contractors, regulators, and government entities as needed according to contractual and regulatory/statutory obligation.

fixtures/policies/invalid-access.md

@@ -0,0 +1,56 @@
+name: Access Onboarding and Termination Policy
+acronym: AOTP
+satisfies:
+TSC:
+- CC6.1
+  - CC6.2
+  - CC6.3 
+majorRevisions:
+- date: Jun 1 2018
+   comment: Initial document
+---
+# Purpose and Scope
+
+a. The purpose of this policy is to define procedures to onboard and offboard users to technical infrastructure in a manner that minimizes the risk of information loss or exposure.
+
+a. This policy applies to all technical infrastructure within the organization.
+
+a. This policy applies to all full-time and part-time employees and contractors.
+
+# Background
+
+a. In order to minimize the risk of information loss or exposure (from both inside and outside the organization), the organization is reliant on the principle of least privilege. Account creation and permission levels are restricted to only the resources absolutely needed to perform each person’s job duties. When a user’s role within the organization changes, those accounts and permission levels are changed/revoked to fit the new role and disabled when the user leaves the organization altogether.
+
+# Policy
+
+a. *During onboarding:*
+
+    i. Hiring Manager informs HR upon hire of a new employee.
+
+    i. HR emails IT to inform them of a new hire and their role. 
+
+    i. IT creates a checklist of accounts and permission levels needed for that role. 
+
+    i. The owner of each resource reviews and approves account creation and the 
+associated permissions.
+
+    i. IT works with the owner of each resource to set up the user. 
+
+a. *During offboarding:*
+
+    i. Hiring Manager notifies HR when an employee has been terminated. 
+
+    i. HR sends a weekly email report to IT summarizing list of users terminated and instructs IT to disable their access. 
+
+    i. IT terminates access within five business days from receipt of notification. 
+
+a. *When an employee changes roles within the organization:*
+
+    i. Hiring Manager will inform HR of a change in role.
+    
+    i. HR and IT will follow the same steps as outlined in the onboarding and offboarding procedures. 
+
+a. *Review of accounts and permissions:*
+
+    i. Each month, IT and HR will review accounts and permission levels for accuracy. 
+

fixtures/procedures/invalid-workstation.md

@@ -0,0 +1,39 @@
+id: "workstation"
+name: "Collect Workstation Details"cron: "0 0 0 15 4 *"
+---
+
+Resolve this ticket by executing the following steps:
+
+- [ ] Send the communications below
+- [ ] For any email replies, attach content to this ticket
+- [ ] Validate responses are received from each
+
+
+```
+To: Desktop support
+Subject: Annual workstation inventory
+
+Please attach the current workstation inventory to the following ticket: [REPLACE WITH URL TO THIS TICKET]
+
+The workstation inventory shall include the following fields:
+    * Serial number
+    * Custodian
+    * Full disk encryption status
+    * Malware protection status
+```
+
+
+```
+To: Outsourced Call Center IT
+Subject: Annual workstation inventory
+
+As part of our ongoing compliance efforts and per our services agreement, we require a current inventory of workstations in use in the service of our account.
+
+Please respond to this message with the current inventory.
+
+The workstation inventory shall include the following fields:
+    * Serial number
+    * Custodian
+    * Full disk encryption status
+    * Malware protection status
+```

fixtures/standards/invalid-standard.yml

@@ -0,0 +1,245 @@
+name: TSC
+***CC1.1:
+  family: CC1
+  name: Integrity and Ethics
+  description: The entity demonstrates a commitment to integrity and ethical values
+CC1.2:
+  family: CC1
+  name: Board Independence
+  description: The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control
+CC1.3:
+  family: CC1
+  name: Organizational Structure
+  description: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives
+CC1.4:
+  family: CC1
+  name: Hiring, Training and Retention
+  description: The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives
+CC1.5:
+  family: CC1
+  name: Individual Accountability
+  description: The entity holds individuals accountable for their internal control responsibilities in the pursuit of objectives.
+CC2.1:
+  family: CC2
+  name: Use of Information Systems
+  description: The entity obtains or generates and uses relevant, quality information to support the functioning of internal control
+CC2.2:
+  family: CC2
+  name: Use of Communication Systems, Internal
+  description: The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control
+CC2.3:
+  family: CC2
+  name: Use of Communication Systems, External
+  description: The entity communicates with external parties regarding matters affecting the functioning of internal control
+CC3.1:
+  family: CC3
+  name: Objectives
+  description: The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives
+CC3.2:
+  family: CC3
+  name: Risk to Objectives
+  description: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed
+CC3.3:
+  family: CC3
+  name: Fraud Risk to Objectives
+  description: The entity considers the potential for fraud in assessing risks to the achievement of objectives
+CC3.4:
+  family: CC3
+  name: Impact of Changes
+  description: The entity identifies and assesses changes that could significantly impact the system of internal control
+CC4.1:
+  family: CC4
+  name: Monitoring
+  description: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning
+CC4.2:
+  family: CC4
+  name: Remediation
+  description: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate
+CC5.1:
+  family: CC5
+  name: Objective Risk Mitigation
+  description: The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels
+CC5.2:
+  family: CC5
+  name: Technology Controls
+  description: The entity also selects and develops general control activities over technology to support the achievement of objectives
+CC5.3:
+  family: CC5
+  name: Established Policies
+  description: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action
+CC6.1:
+  family: CC6
+  name: Logical Access
+  description: The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity’s objectives
+CC6.2:
+  family: CC6
+  name: User Access
+  description: Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized
+CC6.3:
+  family: CC6
+  name: Role-Based Access
+  description: The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity’s objectives
+CC6.4:
+  family: CC6
+  name: Physical Access
+  description: The entity restricts physical access to facilities and protected information assets (for example, data center facilities, back-up media storage, and other sensitive locations) to authorized personnel to meet the entity’s objectives
+CC6.5:
+  family: CC6
+  name: Data Disposal
+  description: The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished and is no longer required to meet the entity’s objectives
+CC6.6:
+  family: CC6
+  name: External Threats
+  description: The entity implements logical access security measures to protect against threats from sources outside its system boundaries
+CC6.7:
+  family: CC6
+  name: Data Custody and Transmission
+  description: The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity’s objectives
+CC6.8:
+  family: CC6
+  name: Malware Detection
+  description: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity’s objectives
+CC7.1:
+  family: CC7
+  name: Vulnerability Detection
+  description: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities
+CC7.2:
+  family: CC7
+  name: Anomaly Detection
+  description: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity’s ability to meet its objectives; anomalies are analyzed to determine whether they represent security events
+CC7.3:
+  family: CC7
+  name: Security Incident Evaluation
+  description: The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures
+CC7.4:
+  family: CC7
+  name: Security Incident Response Plan
+  description: The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate
+CC7.5:
+  family: CC7
+  name: Security Incident Response Execution
+  description: The entity identifies, develops, and implements activities to recover from identified security incidents
+CC8.1:
+  family: CC8
+  name: Change Control
+  description: The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives
+CC9.1:
+  family: CC9
+  name: Disruption Risk Mitigation
+  description: The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions
+CC9.2:
+  family: CC9
+  name: Vendor Risk Management
+  description: The entity assesses and manages risks associated with vendors and business partners
+A1.1:
+  family: A1
+  name: Capacity Planning
+  description: The entity maintains, monitors, and evaluates current processing capacity and use of system components (infrastructure, data, and software) to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives
+A1.2:
+  family: A1
+  name: Backup and Recovery
+  description: The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives
+A1.3:
+  family: A1
+  name: Recovery Testing
+  description: The entity tests recovery plan procedures supporting system recovery to meet its objectives
+C1.1:
+  family: C1
+  name: Confidential Information Identification
+  description: The entity identifies and maintains confidential information to meet the entity’s objectives related to confidentiality
+C1.2:
+  family: C1
+  name: Confidential Information Disposal
+  description: The entity disposes of confidential information to meet the entity’s objectives related to confidentiality.
+PI1.1:
+  family: PI1
+  name: Processing Integrity Monitoring
+  description: The entity obtains or generates, uses, and communicates relevant, quality information regarding the objectives related to processing, including definitions of data processed and product and service speci cations, to support the use of products and services
+PI1.2:
+  family: PI1
+  name: Processing Integrity Accuracy
+  description: The entity implements policies and procedures over system inputs, including controls over completeness and accuracy, to result in products, services, and reporting to meet the entity’s objectives
+PI1.3:
+  family: PI1
+  name: Processing Integrity Operations
+  description: The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity’s objectives
+PI1.4:
+  family: PI1
+  name: Processing Integrity Outputs
+  description: The entity implements policies and procedures to make available or deliver output completely, accurately, and timely in accordance with specifications to meet the entity’s objectives
+PI1.5:
+  family: PI1
+  name: Processing Integrity Backups
+  description: The entity implements policies and procedures to store inputs, items in processing, and outputs completely, accurately, and timely in accordance with system specifications to meet the entity’s objectives
+P1.1:
+  family: P1
+  name: Privacy Notification
+  description: The entity provides notice to data subjects about its privacy practices to meet the entity’s objectives related to privacy. The notice is updated and communicated to data subjects in a timely manner for changes to the entity’s privacy practices, including changes in the use of personal information, to meet the entity’s objectives related to privacy
+P2.1:
+  family: P2
+  name: Privacy Consent and Choice
+  description: The entity communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information to the data subjects and the consequences, if any, of each choice. Explicit consent for the collection, use, retention, disclosure, and disposal of personal information is obtained from data subjects or other authorized persons, if required. Such consent is obtained only for the intended purpose of the information to meet the entity’s objectives related to privacy. The entity’s basis for determining implicit consent for the collection, use, retention, disclosure, and disposal of personal information is documented
+P3.1:
+  family: P3
+  name: Personal Information Collection
+  description: Personal information is collected consistent with the entity’s objectives related to privacy
+P3.2:
+  family: P3
+  name: Explicit Consent
+  description: For information requiring explicit consent, the entity communicates the need for such consent, as well as the consequences of a failure to provide consent for the request for personal information, and obtains the consent prior to the collection of the information to meet the entity’s objectives related to privacy
+P4.1:
+  family: P4
+  name: Proper Use of Personal Information
+  description: The entity limits the use of personal information to the purposes identified in the entity’s objectives related to privacy
+P4.2:
+  family: P4
+  name: Personal Information Retention
+  description: The entity retains personal information consistent with the entity’s objectives related to privacy
+P4.3:
+  family: P4
+  name: Personal Information Disposal
+  description: The entity securely disposes of personal information to meet the entity’s objectives related to privacy
+P5.1:
+  family: P5
+  name: Data Subject Access
+  description: The entity grants identified and authenticated data subjects the ability to access their stored personal information for review and, upon request, provides physical or electronic copies of that information to data subjects to meet the entity’s objectives related to privacy. If access is denied, data subjects are informed of the denial and reason for such denial, as required, to meet the entity’s objectives related to privacy
+P5.2:
+  family: P5
+  name: Data Subject Amendment
+  description: The entity corrects, amends, or appends personal information based on information provided by data subjects and communicates such information to third parties, as committed or required, to meet the entity’s objectives related to privacy. If a request for correction is denied, data subjects are informed of the denial and reason for such denial to meet the entity’s objectives related to privacy
+P6.1:
+  family: P6
+  name: Consent for Third Party Disclosure
+  description: The entity discloses personal information to third parties with the explicit consent of data subjects, and such consent is obtained prior to disclosure to meet the entity’s objectives related to privacy
+P6.2:
+  family: P6
+  name: Authorized Disclosures
+  description: The entity creates and retains a complete, accurate, and timely record of authorized disclosures of personal information to meet the entity’s objectives related to privacy
+P6.3:
+  family: P6
+  name: Unauthorized Disclosures
+  description: The entity creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures (including breaches) of personal information to meet the entity’s objectives related to privacy
+P6.4:
+  family: P6
+  name: Appropriate Third Party Disclosure
+  description: The entity obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity’s objectives related to privacy. The entity assesses those parties’ compliance on a periodic and as-needed basis and takes corrective action, if necessary
+P6.5:
+  family: P6
+  name: Unauthorized Third Party Disclosure
+  description: The entity obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorized disclosures of personal information. Such notifications are reported to appropriate personnel and acted on in accordance with established incident response procedures to meet the entity’s objectives related to privacy
+P6.6:
+  family: P6
+  name: Notification of Unauthorized Third Party Disclosure
+  description: The entity provides notification of breaches and incidents to affected data subjects, regulators, and others to meet the entity’s objectives related to privacy
+P6.7:
+  family: P6
+  name: Accounting of Personal Information
+  description: The entity provides data subjects with an accounting of the personal information held and disclosure of the data subjects’ personal information, upon the data subjects’ request, to meet the entity’s objectives related to privacy
+P7.1:
+  family: P7
+  name: Accuracy of Personal Information
+  description: The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet the entity’s objectives related to privacy
+P8.1:
+  family: P8
+  name: Personal Information Dispute Resolution
+  description: The entity implements a process for receiving, addressing, resolving, and communicating the resolution of inquiries, complaints, and disputes from data subjects and others and periodically monitors compliance to meet the entity’s objectives related to privacy. Corrections and other necessary actions related to identified deficiencies are made or taken in a timely manner

go.mod

@@ -25,6 +25,7 @@ require (
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.0 // indirect
 	github.com/jcelliott/lumber v0.0.0-20160324203708-dd349441af25 // indirect
+	github.com/joho/godotenv v1.4.0
 	github.com/juju/ansiterm v0.0.0-20210929141451-8b71cc96ebdc // indirect
 	github.com/kevinburke/rest v0.0.0-20210506044642-5611499aa33c // indirect
 	github.com/manifoldco/promptui v0.8.0

go.sum

@@ -598,6 +598,8 @@ github.com/jmespath/go-jmespath v0.3.0/go.mod h1:9QtRXoHjLGCJ5IBSaohpXITPlowMeeY
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
+github.com/joho/godotenv v1.4.0 h1:3l4+N6zfMWnkbPEXKng2o2/MR5mSwTrBih4ZEkkz1lg=
+github.com/joho/godotenv v1.4.0/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=

internal/cli/app.go

@@ -137,10 +137,10 @@ func notifyVersion(c *cli.Context) error {
 func pandocMustExist(c *cli.Context) error {
 	eitherMustExistErr := fmt.Errorf("\n\nPlease install either Docker or the pandoc package and re-run `%s`. Find OS-specific pandoc installation instructions at: https://pandoc.org/installing.html", c.Command.Name)
 
-	pandocExistErr, found, goodVersion, pdfLatex := pandocBinaryMustExist(c)
+	pandocBinaryExistErr, found, goodVersion, pdfLatex := pandocBinaryMustExist(c)
 	dockerExistErr, inPath, isRunning := dockerMustExist(c)
 
-	config.SetPandoc(pandocExistErr == nil, dockerExistErr == nil)
+	config.SetPandoc(pandocBinaryExistErr == nil, dockerExistErr == nil)
 	check := func(b bool) string {
 		if b {
 			return "✔"
@@ -150,7 +150,7 @@ func pandocMustExist(c *cli.Context) error {
 
 	}
 
-	if pandocExistErr != nil && dockerExistErr != nil {
+	if pandocBinaryExistErr != nil && dockerExistErr != nil {
 
 		fmt.Printf(`
 [%s] pandoc binary installed and in PATH
@@ -165,14 +165,20 @@ func pandocMustExist(c *cli.Context) error {
 	}
 
 	// if we don't have pandoc, but we do have docker, execute a pull
-	if (pandocExistErr != nil && dockerExistErr == nil) || config.WhichPandoc() == config.UseDocker {
+	if !pandocImageExists(context.Background()) && ((pandocBinaryExistErr != nil && dockerExistErr == nil) || config.WhichPandoc() == config.UseDocker) {
+		canPullPandoc := strings.TrimSpace(strings.ToLower(os.Getenv("COMPLY_USE_LOCAL_PANDOC"))) != "true"
+		if canPullPandoc {
+			fmt.Println("Pulling docker image")
 			dockerPull(c)
+		} else {
+			return fmt.Errorf("Local Pandoc not found. Please set COMPLY_USE_LOCAL_PANDOC to false")
+		}
 	}
 
 	return nil
 }
 
-func pandocBinaryMustExist(c *cli.Context) (e error, found, goodVersion, pdfLatex bool) {
+var pandocBinaryMustExist = func(c *cli.Context) (e error, found, goodVersion, pdfLatex bool) {
 	cmd := exec.Command("pandoc", "-v")
 	outputRaw, err := cmd.Output()
 
@@ -230,7 +236,7 @@ func pandocBinaryMustExist(c *cli.Context) (e error, found, goodVersion, pdfLate
 	return e, found, goodVersion, pdfLatex
 }
 
-func dockerMustExist(c *cli.Context) (e error, inPath, isRunning bool) {
+var dockerMustExist = func(c *cli.Context) (e error, inPath, isRunning bool) {
 	dockerErr := fmt.Errorf("Docker must be available in order to run `%s`", c.Command.Name)
 
 	inPath = true
@@ -257,7 +263,26 @@ func dockerMustExist(c *cli.Context) (e error, inPath, isRunning bool) {
 	return nil, inPath, isRunning
 }
 
-func dockerPull(c *cli.Context) error {
+var pandocImageExists = func(ctx context.Context) bool {
+	cli, err := client.NewEnvClient()
+	if err != nil {
+		return false
+	}
+	options := types.ImageListOptions{All: true}
+	imageList, err := cli.ImageList(ctx, options)
+	if err != nil {
+		return false
+	}
+	for _, image := range imageList {
+		if strings.Contains(image.RepoTags[0], "strongdm/pandoc") {
+			return true
+		}
+	}
+
+	return false
+}
+
+var dockerPull = func(c *cli.Context) error {
 	dockerErr := fmt.Errorf("Docker must be available in order to run `%s`", c.Command.Name)
 
 	ctx := context.Background()
@@ -275,7 +300,7 @@ func dockerPull(c *cli.Context) error {
 
 		select {
 		case <-longishPull:
-			fmt.Print("Pulling strongdm/pandoc:latest Docker image (this will take some time) ")
+			fmt.Print("Pulling strongdm/pandoc:edge Docker image (this will take some time) ")
 
 			go func() {
 				for {
@@ -294,7 +319,7 @@ func dockerPull(c *cli.Context) error {
 		}
 	}()
 
-	r, err := cli.ImagePull(ctx, "strongdm/pandoc:latest", types.ImagePullOptions{})
+	r, err := cli.ImagePull(ctx, "strongdm/pandoc:edge", types.ImagePullOptions{})
 	if err != nil {
 		return dockerErr
 	}

internal/cli/app_test.go

@@ -0,0 +1,189 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"os"
+	"reflect"
+	"testing"
+
+	"github.com/strongdm/comply/internal/util"
+	"github.com/urfave/cli"
+)
+
+type PandocMustExist struct{}
+
+func TestPandocMustExist(t *testing.T) {
+	util.ExecuteTests(t, reflect.TypeOf(PandocMustExist{}), beforeEach, nil)
+}
+
+func beforeEach() {
+	util.MockConfig()
+}
+
+func (tg PandocMustExist) WhenBinaryExists(t *testing.T) {
+	dockerPullCalled := false
+
+	pandocBinaryMustExist = func(c *cli.Context) (e error, found, goodVersion, pdfLatex bool) {
+		return nil, true, true, true
+	}
+
+	dockerMustExist = func(c *cli.Context) (e error, inPath bool, isRunning bool) {
+		return errors.New("docker doesn't exist"), false, false
+	}
+
+	pandocImageExists = func(ctx context.Context) bool {
+		return false
+	}
+
+	dockerPull = func(c *cli.Context) error {
+		dockerPullCalled = true
+		return nil
+	}
+
+	pandocMustExist(&cli.Context{})
+
+	if dockerPullCalled != false {
+		t.Fatal("Docker was pulled")
+	}
+}
+
+func (tg PandocMustExist) WhenImageExists(t *testing.T) {
+	dockerPullCalled := false
+
+	pandocBinaryMustExist = func(c *cli.Context) (e error, found, goodVersion, pdfLatex bool) {
+		return errors.New("binary doesn't exist"), false, true, true
+	}
+
+	dockerMustExist = func(c *cli.Context) (e error, inPath bool, isRunning bool) {
+		return errors.New("docker doesn't exist"), false, false
+	}
+
+	pandocImageExists = func(ctx context.Context) bool {
+		return true
+	}
+
+	dockerPull = func(c *cli.Context) error {
+		dockerPullCalled = true
+		return nil
+	}
+
+	pandocMustExist(&cli.Context{})
+
+	if dockerPullCalled != false {
+		t.Fatal("Docker was pulled")
+	}
+}
+
+func (tg PandocMustExist) WhenBinaryAndImageDontExists(t *testing.T) {
+	dockerPullCalled := false
+
+	pandocBinaryMustExist = func(c *cli.Context) (e error, found, goodVersion, pdfLatex bool) {
+		return errors.New("binary doesn't exist"), false, false, false
+	}
+
+	dockerMustExist = func(c *cli.Context) (e error, inPath bool, isRunning bool) {
+		return nil, true, false
+	}
+
+	pandocImageExists = func(ctx context.Context) bool {
+		return false
+	}
+
+	dockerPull = func(c *cli.Context) error {
+		dockerPullCalled = true
+		return nil
+	}
+
+	pandocMustExist(&cli.Context{})
+
+	if dockerPullCalled != true {
+		t.Fatal("Docker wasn't pulled")
+	}
+}
+
+func (tg PandocMustExist) WhenCannotPullPandoc(t *testing.T) {
+	dockerPullCalled := false
+
+	pandocBinaryMustExist = func(c *cli.Context) (e error, found, goodVersion, pdfLatex bool) {
+		return errors.New("binary doesn't exist"), false, false, false
+	}
+
+	dockerMustExist = func(c *cli.Context) (e error, inPath bool, isRunning bool) {
+		return errors.New("docker doesn't exist"), false, false
+	}
+
+	pandocImageExists = func(ctx context.Context) bool {
+		return false
+	}
+
+	dockerPull = func(c *cli.Context) error {
+		dockerPullCalled = true
+		return nil
+	}
+
+	pandocMustExist(&cli.Context{})
+
+	if dockerPullCalled != false {
+		t.Fatal("Docker was pulled")
+	}
+}
+
+func (tg PandocMustExist) WhenMustUseLocalPandoc(t *testing.T) {
+	os.Setenv("COMPLY_USE_LOCAL_PANDOC", "true")
+	dockerPullCalled := false
+
+	pandocBinaryMustExist = func(c *cli.Context) (e error, found, goodVersion, pdfLatex bool) {
+		return errors.New("binary doesn't exist"), false, false, false
+	}
+
+	dockerMustExist = func(c *cli.Context) (e error, inPath bool, isRunning bool) {
+		return errors.New("docker doesn't exist"), false, false
+	}
+
+	pandocImageExists = func(ctx context.Context) bool {
+		return true
+	}
+
+	dockerPull = func(c *cli.Context) error {
+		dockerPullCalled = true
+		return nil
+	}
+
+	pandocMustExist(&cli.Context{})
+
+	if dockerPullCalled != false {
+		t.Fatal("Docker was pulled")
+	}
+
+	os.Clearenv()
+}
+
+func (tg PandocMustExist) WhenPandocDontExistsAndCannotPull(t *testing.T) {
+	os.Setenv("COMPLY_USE_LOCAL_PANDOC", "true")
+	dockerPullCalled := false
+
+	pandocBinaryMustExist = func(c *cli.Context) (e error, found, goodVersion, pdfLatex bool) {
+		return errors.New("binary doesn't exist"), false, false, false
+	}
+
+	dockerMustExist = func(c *cli.Context) (e error, inPath bool, isRunning bool) {
+		return nil, true, false
+	}
+
+	pandocImageExists = func(ctx context.Context) bool {
+		return false
+	}
+
+	dockerPull = func(c *cli.Context) error {
+		dockerPullCalled = true
+		return nil
+	}
+
+	pandocMustExist(&cli.Context{})
+
+	if dockerPullCalled != false {
+		t.Fatal("Docker was pulled")
+	}
+	os.Clearenv()
+}

internal/config/config.go

@@ -82,7 +82,7 @@ func Exists() bool {
 }
 
 // Config is the parsed contents of ProjectRoot()/config.yml.
-func Config() *Project {
+var Config = func() *Project {
 	p := Project{}
 	cfgBytes, err := ioutil.ReadFile(filepath.Join(ProjectRoot(), "comply.yml"))
 	if err != nil {

internal/model/fs.go

@@ -84,6 +84,10 @@ func ReadStandards() ([]*Standard, error) {
 		}
 
 		yaml.Unmarshal(sBytes, &s)
+		err = yaml.Unmarshal(sBytes, &s)
+		if err != nil {
+			return nil, errors.Wrap(err, "unable to parse "+f.FullPath)
+		}
 		standards = append(standards, s)
 	}
 
@@ -101,7 +105,10 @@ func ReadNarratives() ([]*Document, error) {
 
 	for _, f := range files {
 		n := &Document{}
-		mdmd := loadMDMD(f.FullPath)
+		mdmd, err := loadMDMD(f.FullPath)
+		if err != nil {
+			return nil, err
+		}
 		err = yaml.Unmarshal([]byte(mdmd.yaml), &n)
 		if err != nil {
 			return nil, errors.Wrap(err, "unable to parse "+f.FullPath)
@@ -126,7 +133,10 @@ func ReadProcedures() ([]*Procedure, error) {
 
 	for _, f := range files {
 		p := &Procedure{}
-		mdmd := loadMDMD(f.FullPath)
+		mdmd, err := loadMDMD(f.FullPath)
+		if err != nil {
+			return nil, err
+		}
 		err = yaml.Unmarshal([]byte(mdmd.yaml), &p)
 		if err != nil {
 			return nil, errors.Wrap(err, "unable to parse "+f.FullPath)
@@ -151,7 +161,10 @@ func ReadPolicies() ([]*Document, error) {
 
 	for _, f := range files {
 		p := &Document{}
-		mdmd := loadMDMD(f.FullPath)
+		mdmd, err := loadMDMD(f.FullPath)
+		if err != nil {
+			return nil, err
+		}
 		err = yaml.Unmarshal([]byte(mdmd.yaml), &p)
 		if err != nil {
 			return nil, errors.Wrap(err, "unable to parse "+f.FullPath)
@@ -171,21 +184,20 @@ type metadataMarkdown struct {
 	body string
 }
 
-func loadMDMD(path string) metadataMarkdown {
+func loadMDMD(path string) (*metadataMarkdown, error) {
 	bytes, err := ioutil.ReadFile(path)
 	if err != nil {
 		panic(err)
 	}
-
 	content := string(bytes)
 	components := strings.Split(content, "---")
 	if components[0] == "" && (len(components) > 1) {
 		components = components[1:]
 	}
 	if len(components) == 1 {
-		panic(fmt.Sprintf("Malformed metadata markdown in %s, must be of the form: YAML\\n---\\nmarkdown content", path))
+		return nil, errors.New(fmt.Sprintf("Malformed metadata markdown in %s, must be of the form: YAML\\n---\\nmarkdown content", path))
 	}
-	yaml := components[0]
+	item := components[0]
 	body := strings.Join(components[1:], "---")
-	return metadataMarkdown{yaml, body}
+	return &metadataMarkdown{item, body}, nil
 }

internal/model/fs_test.go

@@ -0,0 +1,238 @@
+package model
+
+import (
+	"fmt"
+	"os"
+	"reflect"
+	"testing"
+
+	"github.com/strongdm/comply/internal/path"
+	"github.com/strongdm/comply/internal/util"
+)
+
+type ReadFiles struct{}
+
+func beforeEach() {
+	util.MockConfig()
+}
+
+func TestReadFiles(t *testing.T) {
+	util.ExecuteTests(t, reflect.TypeOf(ReadFiles{}), beforeEach, nil)
+}
+
+// TestReadNarratives calls model.ReadNarratives checking for a valid return value.
+func (tg ReadFiles) TestReadNarratives(t *testing.T) {
+	filePath := fmt.Sprintf("%s/narratives/control.md", util.GetRootPath())
+	fileInfo, _ := os.Lstat(filePath)
+	path.Narratives = func() ([]path.File, error) {
+		return []path.File{
+			{FullPath: filePath, Info: fileInfo},
+		}, nil
+	}
+
+	documents, err := ReadNarratives()
+	if err != nil {
+		t.Fatalf(`ReadNarratives() returned an error %v`, err)
+	}
+	if len(documents) != 1 {
+		t.Fatal(`Invalid number of documents`)
+	}
+	if documents[0].FullPath != filePath {
+		t.Fatalf(`Invalid document path %s`, documents[0].FullPath)
+	}
+}
+
+// TestReadNarrativesWhenThereAreNoNarratives calls model.ReadNarratives checking for a valid return when
+// there are no narratives to process
+func (tg ReadFiles) TestReadNarrativesWhenThereAreNoNarratives(t *testing.T) {
+	path.Narratives = func() ([]path.File, error) {
+		return []path.File{}, nil
+	}
+
+	documents, err := ReadNarratives()
+	if err != nil {
+		t.Fatalf(`ReadNarratives() returned an error %v`, err)
+	}
+	if len(documents) != 0 {
+		t.Fatal(`Invalid number of documents`)
+	}
+}
+
+// TestReadNarrativesFailsWhenInvalidNarrative calls model.ReadNarratives checking for an error return when
+// there is an invalid narrative
+func (tg ReadFiles) TestReadNarrativesFailsWhenInvalidNarrative(t *testing.T) {
+	path.Narratives = func() ([]path.File, error) {
+		filePath := fmt.Sprintf("%s/../fixtures/narratives/invalid-control.md", util.GetRootPath())
+		fileInfo, _ := os.Lstat(filePath)
+		return []path.File{
+			{FullPath: filePath, Info: fileInfo},
+		}, nil
+	}
+
+	_, err := ReadNarratives()
+	if err == nil {
+		t.Fatal(`ReadNarratives() was expected to fail`)
+	}
+}
+
+// TestReadProcedures calls model.ReadProcedures checking for a valid return value.
+func (tg ReadFiles) TestReadProcedures(t *testing.T) {
+	filePath := fmt.Sprintf("%s/procedures/workstation.md", util.GetRootPath())
+	fileInfo, _ := os.Lstat(filePath)
+	path.Procedures = func() ([]path.File, error) {
+		return []path.File{
+			{FullPath: filePath, Info: fileInfo},
+		}, nil
+	}
+
+	documents, err := ReadProcedures()
+	if err != nil {
+		t.Fatalf(`ReadProcedures() returned an error %v`, err)
+	}
+	if len(documents) != 1 {
+		t.Fatal(`Invalid number of documents`)
+	}
+	if documents[0].FullPath != filePath {
+		t.Fatalf(`Invalid document path %s`, documents[0].FullPath)
+	}
+}
+
+// TestReadProceduresWhenThereAreNoProcedures calls model.ReadProcedures checking for a valid return when
+// there are no procedures to process
+func (tg ReadFiles) TestReadProceduresWhenThereAreNoProcedures(t *testing.T) {
+	path.Procedures = func() ([]path.File, error) {
+		return []path.File{}, nil
+	}
+
+	documents, err := ReadProcedures()
+	if err != nil {
+		t.Fatalf(`ReadProcedures() returned an error %v`, err)
+	}
+	if len(documents) != 0 {
+		t.Fatal(`Invalid number of documents`)
+	}
+}
+
+// TestReadProceduresFailsWhenInvalidProcedure calls model.ReadProcedures checking for an error return when
+// there is an invalid procedure
+func (tg ReadFiles) TestReadProceduresFailsWhenInvalidProcedure(t *testing.T) {
+	path.Procedures = func() ([]path.File, error) {
+		filePath := fmt.Sprintf("%s/../fixtures/procedures/invalid-workstation.md", util.GetRootPath())
+		fileInfo, _ := os.Lstat(filePath)
+		return []path.File{
+			{FullPath: filePath, Info: fileInfo},
+		}, nil
+	}
+
+	_, err := ReadProcedures()
+	if err == nil {
+		t.Fatal(`ReadProcedures() was expected to fail`, err)
+	}
+}
+
+// TestReadPolicies calls model.ReadPolicies checking for a valid return value.
+func (tg ReadFiles) TestReadPolicies(t *testing.T) {
+	filePath := fmt.Sprintf("%s/policies/access.md", util.GetRootPath())
+	fileInfo, _ := os.Lstat(filePath)
+	path.Policies = func() ([]path.File, error) {
+		return []path.File{
+			{FullPath: filePath, Info: fileInfo},
+		}, nil
+	}
+
+	documents, err := ReadPolicies()
+	if err != nil {
+		t.Fatalf(`ReadPolicies() returned an error %v`, err)
+	}
+	if len(documents) != 1 {
+		t.Fatal(`Invalid number of documents`)
+	}
+	if documents[0].FullPath != filePath {
+		t.Fatalf(`Invalid document path %s`, documents[0].FullPath)
+	}
+}
+
+// TestReadPoliciesWhenThereAreNoPolicies calls model.ReadPolicies checking for a valid return when
+// there are no policies to process
+func (tg ReadFiles) TestReadPoliciesWhenThereAreNoPolicies(t *testing.T) {
+	path.Policies = func() ([]path.File, error) {
+		return []path.File{}, nil
+	}
+
+	documents, err := ReadPolicies()
+	if err != nil {
+		t.Fatalf(`ReadPolicies() returned an error %v`, err)
+	}
+	if len(documents) != 0 {
+		t.Fatal(`Invalid number of documents`)
+	}
+}
+
+// TestReadPoliciesFailsWhenInvalidPolicy calls model.ReadPolicies checking for an error return when
+// there is an invalid policy
+func (tg ReadFiles) TestReadPoliciesFailsWhenInvalidPolicy(t *testing.T) {
+	path.Policies = func() ([]path.File, error) {
+		filePath := fmt.Sprintf("%s/../fixtures/policies/invalid-access.md", util.GetRootPath())
+		fileInfo, _ := os.Lstat(filePath)
+		return []path.File{
+			{FullPath: filePath, Info: fileInfo},
+		}, nil
+	}
+
+	_, err := ReadPolicies()
+	if err == nil {
+		t.Fatal(`ReadPolicies() was expected to fail`, err)
+	}
+}
+
+// TestReadStandards calls model.ReadStandards checking for a valid return value.
+func (tg ReadFiles) TestReadStandards(t *testing.T) {
+	filePath := fmt.Sprintf("%s/standards/TSC-2017.yml", util.GetRootPath())
+	fileInfo, _ := os.Lstat(filePath)
+	path.Standards = func() ([]path.File, error) {
+		return []path.File{
+			{FullPath: filePath, Info: fileInfo},
+		}, nil
+	}
+
+	documents, err := ReadStandards()
+	if err != nil {
+		t.Fatalf(`ReadStandards() returned an error %v`, err)
+	}
+	if len(documents) != 1 {
+		t.Fatal(`Invalid number of documents`)
+	}
+}
+
+// TestReadStandardsWhenThereAreNoStandards calls model.ReadStandards checking for a valid return when
+// there are no standards to process
+func (tg ReadFiles) TestReadStandardsWhenThereAreNoStandards(t *testing.T) {
+	path.Standards = func() ([]path.File, error) {
+		return []path.File{}, nil
+	}
+
+	documents, err := ReadStandards()
+	if err != nil {
+		t.Fatalf(`ReadStandards() returned an error %v`, err)
+	}
+	if len(documents) != 0 {
+		t.Fatal(`Invalid number of documents`)
+	}
+}
+
+// TestReadStandardsFailsWhenInvalidStandard calls model.ReadStandards checking for an error return when
+// there is an invalid standard
+func (tg ReadFiles) TestReadStandardsFailsWhenInvalidStandard(t *testing.T) {
+	path.Standards = func() ([]path.File, error) {
+		filePath := fmt.Sprintf("%s/../fixtures/standards/invalid-standard.yml", util.GetRootPath())
+		fileInfo, _ := os.Lstat(filePath)
+		return []path.File{
+			{FullPath: filePath, Info: fileInfo},
+		}, nil
+	}
+
+	_, err := ReadStandards()
+	if err == nil {
+		t.Fatal(`ReadStandards() was expected to fail`, err)
+	}
+}

internal/model/model_test.go

@@ -9,36 +9,32 @@ import (
 func TestMarshal(t *testing.T) {
 	d := Data{
 		Tickets: []*Ticket{
-			&Ticket{
+			{
 				ID: "t1",
 			},
 		},
 		Audits: []*Audit{
-			&Audit{
+			{
 				ID: "a1",
 			},
 		},
 		Procedures: []*Procedure{
-			&Procedure{
+			{
-				Code: "pro1",
+				ID: "pro1",
 			},
 		},
-		Policies: []*Policy{
+		Policies: []*Document{
-			&Policy{
+			{
 				Name: "pol1",
 			},
 		},
 	}
-
 	m, _ := json.Marshal(d)
-
 	encoded := string(m)
-
 	if !strings.Contains(encoded, "t1") ||
 		!strings.Contains(encoded, "a1") ||
 		!strings.Contains(encoded, "pro1") ||
 		!strings.Contains(encoded, "pol1") {
 		t.Error("identifier not found in marshalled string")
 	}
-
 }

internal/path/path.go

@@ -16,22 +16,22 @@ type File struct {
 }
 
 // Standards lists all standard files.
-func Standards() ([]File, error) {
+var Standards = func() ([]File, error) {
 	return filesFor("standards", "yml")
 }
 
 // Narratives lists all narrative files.
-func Narratives() ([]File, error) {
+var Narratives = func() ([]File, error) {
 	return filesFor("narratives", "md")
 }
 
 // Policies lists all policy files.
-func Policies() ([]File, error) {
+var Policies = func() ([]File, error) {
 	return filesFor("policies", "md")
 }
 
 // Procedures lists all procedure files.
-func Procedures() ([]File, error) {
+var Procedures = func() ([]File, error) {
 	return filesFor("procedures", "md")
 }
 

internal/render/document.go

@@ -135,9 +135,12 @@ func preprocessDoc(data *renderData, pol *model.Document, fullPath string) error
 %% %s
 
 ---
-header-includes: yes
+header-includes: |
-head-content: "%s"
+	\usepackage{fancyhdr}
-foot-content: "%s confidential %d"
+	\pagestyle{fancy}
+	\fancyhead{}
+	\fancyhead[RO,RE]{%s}
+	\fancyfoot[LO,LE]{%s confidential %d}
 ---
 
 %s

internal/render/pandoc.go

@@ -64,7 +64,7 @@ func dockerPandoc(outputFilename string, errOutputCh chan error) {
 			errOutputCh <- errors.Wrap(err, "unable to remove container")
 			return
 		}
-		errOutputCh <-nil
+		errOutputCh <- nil
 	}()
 
 	err = cli.ContainerStart(ctx, resp.ID, types.ContainerStartOptions{})
@@ -78,7 +78,7 @@ func dockerPandoc(outputFilename string, errOutputCh chan error) {
 
 	if resultValue.StatusCode != 0 {
 		err = <-chanErr
-		errOutputCh <-errors.Wrap(err, "error awaiting Docker container")
+		errOutputCh <- errors.Wrap(err, "error awaiting Docker container")
 		return
 	}
 

internal/util/test_utils.go

@@ -0,0 +1,52 @@
+package util
+
+import (
+	"fmt"
+	"io/ioutil"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"testing"
+
+	"github.com/strongdm/comply/internal/config"
+	"gopkg.in/yaml.v2"
+)
+
+type TestFixture func()
+
+func ExecuteTests(t *testing.T, testGroupType reflect.Type, beforeEach TestFixture, afterEach TestFixture) {
+	testGroup := reflect.New(testGroupType).Elem().Interface()
+	for i := 0; i < testGroupType.NumMethod(); i++ {
+		m := testGroupType.Method(i)
+		t.Run(m.Name, func(t *testing.T) {
+			if beforeEach != nil {
+				beforeEach()
+			}
+
+			in := []reflect.Value{reflect.ValueOf(testGroup), reflect.ValueOf(t)}
+			m.Func.Call(in)
+
+			if afterEach != nil {
+				afterEach()
+			}
+		})
+	}
+}
+
+func MockConfig() {
+	config.Config = func() *config.Project {
+		p := config.Project{}
+		cfgBytes, _ := ioutil.ReadFile(filepath.Join(GetRootPath(), "comply.yml.example"))
+		err := yaml.Unmarshal(cfgBytes, &p)
+		if err != nil {
+			return nil
+		}
+		return &p
+	}
+}
+
+func GetRootPath() string {
+	_, fileName, _, _ := runtime.Caller(0)
+	fileDir := filepath.Dir(fileName)
+	return fmt.Sprintf("%s/../../example", fileDir)
+}

vendor/github.com/joho/godotenv/.gitignore

@@ -0,0 +1 @@
+.DS_Store

vendor/github.com/joho/godotenv/LICENCE

@@ -0,0 +1,23 @@
+Copyright (c) 2013 John Barton
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+

vendor/github.com/joho/godotenv/README.md

@@ -0,0 +1,188 @@
+# GoDotEnv ![CI](https://github.com/joho/godotenv/workflows/CI/badge.svg) [![Go Report Card](https://goreportcard.com/badge/github.com/joho/godotenv)](https://goreportcard.com/report/github.com/joho/godotenv)
+
+A Go (golang) port of the Ruby dotenv project (which loads env vars from a .env file)
+
+From the original Library:
+
+> Storing configuration in the environment is one of the tenets of a twelve-factor app. Anything that is likely to change between deployment environments–such as resource handles for databases or credentials for external services–should be extracted from the code into environment variables.
+>
+> But it is not always practical to set environment variables on development machines or continuous integration servers where multiple projects are run. Dotenv load variables from a .env file into ENV when the environment is bootstrapped.
+
+It can be used as a library (for loading in env for your own daemons etc) or as a bin command.
+
+There is test coverage and CI for both linuxish and windows environments, but I make no guarantees about the bin version working on windows.
+
+## Installation
+
+As a library
+
+```shell
+go get github.com/joho/godotenv
+```
+
+or if you want to use it as a bin command
+```shell
+go get github.com/joho/godotenv/cmd/godotenv
+```
+
+## Usage
+
+Add your application configuration to your `.env` file in the root of your project:
+
+```shell
+S3_BUCKET=YOURS3BUCKET
+SECRET_KEY=YOURSECRETKEYGOESHERE
+```
+
+Then in your Go app you can do something like
+
+```go
+package main
+
+import (
+    "github.com/joho/godotenv"
+    "log"
+    "os"
+)
+
+func main() {
+  err := godotenv.Load()
+  if err != nil {
+    log.Fatal("Error loading .env file")
+  }
+
+  s3Bucket := os.Getenv("S3_BUCKET")
+  secretKey := os.Getenv("SECRET_KEY")
+
+  // now do something with s3 or whatever
+}
+```
+
+If you're even lazier than that, you can just take advantage of the autoload package which will read in `.env` on import
+
+```go
+import _ "github.com/joho/godotenv/autoload"
+```
+
+While `.env` in the project root is the default, you don't have to be constrained, both examples below are 100% legit
+
+```go
+_ = godotenv.Load("somerandomfile")
+_ = godotenv.Load("filenumberone.env", "filenumbertwo.env")
+```
+
+If you want to be really fancy with your env file you can do comments and exports (below is a valid env file)
+
+```shell
+# I am a comment and that is OK
+SOME_VAR=someval
+FOO=BAR # comments at line end are OK too
+export BAR=BAZ
+```
+
+Or finally you can do YAML(ish) style
+
+```yaml
+FOO: bar
+BAR: baz
+```
+
+as a final aside, if you don't want godotenv munging your env you can just get a map back instead
+
+```go
+var myEnv map[string]string
+myEnv, err := godotenv.Read()
+
+s3Bucket := myEnv["S3_BUCKET"]
+```
+
+... or from an `io.Reader` instead of a local file
+
+```go
+reader := getRemoteFile()
+myEnv, err := godotenv.Parse(reader)
+```
+
+... or from a `string` if you so desire
+
+```go
+content := getRemoteFileContent()
+myEnv, err := godotenv.Unmarshal(content)
+```
+
+### Precedence & Conventions
+
+Existing envs take precedence of envs that are loaded later.
+
+The [convention](https://github.com/bkeepers/dotenv#what-other-env-files-can-i-use)
+for managing multiple environments (i.e. development, test, production)
+is to create an env named `{YOURAPP}_ENV` and load envs in this order:
+
+```go
+env := os.Getenv("FOO_ENV")
+if "" == env {
+  env = "development"
+}
+
+godotenv.Load(".env." + env + ".local")
+if "test" != env {
+  godotenv.Load(".env.local")
+}
+godotenv.Load(".env." + env)
+godotenv.Load() // The Original .env
+```
+
+If you need to, you can also use `godotenv.Overload()` to defy this convention
+and overwrite existing envs instead of only supplanting them. Use with caution.
+
+### Command Mode
+
+Assuming you've installed the command as above and you've got `$GOPATH/bin` in your `$PATH`
+
+```
+godotenv -f /some/path/to/.env some_command with some args
+```
+
+If you don't specify `-f` it will fall back on the default of loading `.env` in `PWD`
+
+### Writing Env Files
+
+Godotenv can also write a map representing the environment to a correctly-formatted and escaped file
+
+```go
+env, err := godotenv.Unmarshal("KEY=value")
+err := godotenv.Write(env, "./.env")
+```
+
+... or to a string
+
+```go
+env, err := godotenv.Unmarshal("KEY=value")
+content, err := godotenv.Marshal(env)
+```
+
+## Contributing
+
+Contributions are most welcome! The parser itself is pretty stupidly naive and I wouldn't be surprised if it breaks with edge cases.
+
+*code changes without tests will not be accepted*
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Added some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request
+
+## Releases
+
+Releases should follow [Semver](http://semver.org/) though the first couple of releases are `v1` and `v1.1`.
+
+Use [annotated tags for all releases](https://github.com/joho/godotenv/issues/30). Example `git tag -a v1.2.1`
+
+## CI
+
+Linux: [![Build Status](https://travis-ci.org/joho/godotenv.svg?branch=master)](https://travis-ci.org/joho/godotenv) Windows: [![Build status](https://ci.appveyor.com/api/projects/status/9v40vnfvvgde64u4)](https://ci.appveyor.com/project/joho/godotenv)
+
+## Who?
+
+The original library [dotenv](https://github.com/bkeepers/dotenv) was written by [Brandon Keepers](http://opensoul.org/), and this port was done by [John Barton](https://johnbarton.co/) based off the tests/fixtures in the original library.

vendor/github.com/joho/godotenv/godotenv.go

@@ -0,0 +1,363 @@
+// Package godotenv is a go port of the ruby dotenv library (https://github.com/bkeepers/dotenv)
+//
+// Examples/readme can be found on the github page at https://github.com/joho/godotenv
+//
+// The TL;DR is that you make a .env file that looks something like
+//
+// 		SOME_ENV_VAR=somevalue
+//
+// and then in your go code you can call
+//
+// 		godotenv.Load()
+//
+// and all the env vars declared in .env will be available through os.Getenv("SOME_ENV_VAR")
+package godotenv
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+const doubleQuoteSpecialChars = "\\\n\r\"!$`"
+
+// Load will read your env file(s) and load them into ENV for this process.
+//
+// Call this function as close as possible to the start of your program (ideally in main)
+//
+// If you call Load without any args it will default to loading .env in the current path
+//
+// You can otherwise tell it which files to load (there can be more than one) like
+//
+//		godotenv.Load("fileone", "filetwo")
+//
+// It's important to note that it WILL NOT OVERRIDE an env variable that already exists - consider the .env file to set dev vars or sensible defaults
+func Load(filenames ...string) (err error) {
+	filenames = filenamesOrDefault(filenames)
+
+	for _, filename := range filenames {
+		err = loadFile(filename, false)
+		if err != nil {
+			return // return early on a spazout
+		}
+	}
+	return
+}
+
+// Overload will read your env file(s) and load them into ENV for this process.
+//
+// Call this function as close as possible to the start of your program (ideally in main)
+//
+// If you call Overload without any args it will default to loading .env in the current path
+//
+// You can otherwise tell it which files to load (there can be more than one) like
+//
+//		godotenv.Overload("fileone", "filetwo")
+//
+// It's important to note this WILL OVERRIDE an env variable that already exists - consider the .env file to forcefilly set all vars.
+func Overload(filenames ...string) (err error) {
+	filenames = filenamesOrDefault(filenames)
+
+	for _, filename := range filenames {
+		err = loadFile(filename, true)
+		if err != nil {
+			return // return early on a spazout
+		}
+	}
+	return
+}
+
+// Read all env (with same file loading semantics as Load) but return values as
+// a map rather than automatically writing values into env
+func Read(filenames ...string) (envMap map[string]string, err error) {
+	filenames = filenamesOrDefault(filenames)
+	envMap = make(map[string]string)
+
+	for _, filename := range filenames {
+		individualEnvMap, individualErr := readFile(filename)
+
+		if individualErr != nil {
+			err = individualErr
+			return // return early on a spazout
+		}
+
+		for key, value := range individualEnvMap {
+			envMap[key] = value
+		}
+	}
+
+	return
+}
+
+// Parse reads an env file from io.Reader, returning a map of keys and values.
+func Parse(r io.Reader) (envMap map[string]string, err error) {
+	envMap = make(map[string]string)
+
+	var lines []string
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		lines = append(lines, scanner.Text())
+	}
+
+	if err = scanner.Err(); err != nil {
+		return
+	}
+
+	for _, fullLine := range lines {
+		if !isIgnoredLine(fullLine) {
+			var key, value string
+			key, value, err = parseLine(fullLine, envMap)
+
+			if err != nil {
+				return
+			}
+			envMap[key] = value
+		}
+	}
+	return
+}
+
+//Unmarshal reads an env file from a string, returning a map of keys and values.
+func Unmarshal(str string) (envMap map[string]string, err error) {
+	return Parse(strings.NewReader(str))
+}
+
+// Exec loads env vars from the specified filenames (empty map falls back to default)
+// then executes the cmd specified.
+//
+// Simply hooks up os.Stdin/err/out to the command and calls Run()
+//
+// If you want more fine grained control over your command it's recommended
+// that you use `Load()` or `Read()` and the `os/exec` package yourself.
+func Exec(filenames []string, cmd string, cmdArgs []string) error {
+	Load(filenames...)
+
+	command := exec.Command(cmd, cmdArgs...)
+	command.Stdin = os.Stdin
+	command.Stdout = os.Stdout
+	command.Stderr = os.Stderr
+	return command.Run()
+}
+
+// Write serializes the given environment and writes it to a file
+func Write(envMap map[string]string, filename string) error {
+	content, err := Marshal(envMap)
+	if err != nil {
+		return err
+	}
+	file, err := os.Create(filename)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	_, err = file.WriteString(content + "\n")
+	if err != nil {
+		return err
+	}
+	file.Sync()
+	return err
+}
+
+// Marshal outputs the given environment as a dotenv-formatted environment file.
+// Each line is in the format: KEY="VALUE" where VALUE is backslash-escaped.
+func Marshal(envMap map[string]string) (string, error) {
+	lines := make([]string, 0, len(envMap))
+	for k, v := range envMap {
+		if d, err := strconv.Atoi(v); err == nil {
+			lines = append(lines, fmt.Sprintf(`%s=%d`, k, d))
+		} else {
+			lines = append(lines, fmt.Sprintf(`%s="%s"`, k, doubleQuoteEscape(v)))
+		}
+	}
+	sort.Strings(lines)
+	return strings.Join(lines, "\n"), nil
+}
+
+func filenamesOrDefault(filenames []string) []string {
+	if len(filenames) == 0 {
+		return []string{".env"}
+	}
+	return filenames
+}
+
+func loadFile(filename string, overload bool) error {
+	envMap, err := readFile(filename)
+	if err != nil {
+		return err
+	}
+
+	currentEnv := map[string]bool{}
+	rawEnv := os.Environ()
+	for _, rawEnvLine := range rawEnv {
+		key := strings.Split(rawEnvLine, "=")[0]
+		currentEnv[key] = true
+	}
+
+	for key, value := range envMap {
+		if !currentEnv[key] || overload {
+			os.Setenv(key, value)
+		}
+	}
+
+	return nil
+}
+
+func readFile(filename string) (envMap map[string]string, err error) {
+	file, err := os.Open(filename)
+	if err != nil {
+		return
+	}
+	defer file.Close()
+
+	return Parse(file)
+}
+
+var exportRegex = regexp.MustCompile(`^\s*(?:export\s+)?(.*?)\s*$`)
+
+func parseLine(line string, envMap map[string]string) (key string, value string, err error) {
+	if len(line) == 0 {
+		err = errors.New("zero length string")
+		return
+	}
+
+	// ditch the comments (but keep quoted hashes)
+	if strings.Contains(line, "#") {
+		segmentsBetweenHashes := strings.Split(line, "#")
+		quotesAreOpen := false
+		var segmentsToKeep []string
+		for _, segment := range segmentsBetweenHashes {
+			if strings.Count(segment, "\"") == 1 || strings.Count(segment, "'") == 1 {
+				if quotesAreOpen {
+					quotesAreOpen = false
+					segmentsToKeep = append(segmentsToKeep, segment)
+				} else {
+					quotesAreOpen = true
+				}
+			}
+
+			if len(segmentsToKeep) == 0 || quotesAreOpen {
+				segmentsToKeep = append(segmentsToKeep, segment)
+			}
+		}
+
+		line = strings.Join(segmentsToKeep, "#")
+	}
+
+	firstEquals := strings.Index(line, "=")
+	firstColon := strings.Index(line, ":")
+	splitString := strings.SplitN(line, "=", 2)
+	if firstColon != -1 && (firstColon < firstEquals || firstEquals == -1) {
+		//this is a yaml-style line
+		splitString = strings.SplitN(line, ":", 2)
+	}
+
+	if len(splitString) != 2 {
+		err = errors.New("Can't separate key from value")
+		return
+	}
+
+	// Parse the key
+	key = splitString[0]
+	if strings.HasPrefix(key, "export") {
+		key = strings.TrimPrefix(key, "export")
+	}
+	key = strings.TrimSpace(key)
+
+	key = exportRegex.ReplaceAllString(splitString[0], "$1")
+
+	// Parse the value
+	value = parseValue(splitString[1], envMap)
+	return
+}
+
+var (
+	singleQuotesRegex  = regexp.MustCompile(`\A'(.*)'\z`)
+	doubleQuotesRegex  = regexp.MustCompile(`\A"(.*)"\z`)
+	escapeRegex        = regexp.MustCompile(`\\.`)
+	unescapeCharsRegex = regexp.MustCompile(`\\([^$])`)
+)
+
+func parseValue(value string, envMap map[string]string) string {
+
+	// trim
+	value = strings.Trim(value, " ")
+
+	// check if we've got quoted values or possible escapes
+	if len(value) > 1 {
+		singleQuotes := singleQuotesRegex.FindStringSubmatch(value)
+
+		doubleQuotes := doubleQuotesRegex.FindStringSubmatch(value)
+
+		if singleQuotes != nil || doubleQuotes != nil {
+			// pull the quotes off the edges
+			value = value[1 : len(value)-1]
+		}
+
+		if doubleQuotes != nil {
+			// expand newlines
+			value = escapeRegex.ReplaceAllStringFunc(value, func(match string) string {
+				c := strings.TrimPrefix(match, `\`)
+				switch c {
+				case "n":
+					return "\n"
+				case "r":
+					return "\r"
+				default:
+					return match
+				}
+			})
+			// unescape characters
+			value = unescapeCharsRegex.ReplaceAllString(value, "$1")
+		}
+
+		if singleQuotes == nil {
+			value = expandVariables(value, envMap)
+		}
+	}
+
+	return value
+}
+
+var expandVarRegex = regexp.MustCompile(`(\\)?(\$)(\()?\{?([A-Z0-9_]+)?\}?`)
+
+func expandVariables(v string, m map[string]string) string {
+	return expandVarRegex.ReplaceAllStringFunc(v, func(s string) string {
+		submatch := expandVarRegex.FindStringSubmatch(s)
+
+		if submatch == nil {
+			return s
+		}
+		if submatch[1] == "\\" || submatch[2] == "(" {
+			return submatch[0][1:]
+		} else if submatch[4] != "" {
+			return m[submatch[4]]
+		}
+		return s
+	})
+}
+
+func isIgnoredLine(line string) bool {
+	trimmedLine := strings.TrimSpace(line)
+	return len(trimmedLine) == 0 || strings.HasPrefix(trimmedLine, "#")
+}
+
+func doubleQuoteEscape(line string) string {
+	for _, c := range doubleQuoteSpecialChars {
+		toReplace := "\\" + string(c)
+		if c == '\n' {
+			toReplace = `\n`
+		}
+		if c == '\r' {
+			toReplace = `\r`
+		}
+		line = strings.Replace(line, string(c), toReplace, -1)
+	}
+	return line
+}

vendor/github.com/joho/godotenv/renovate.json

@@ -0,0 +1,5 @@
+{
+  "extends": [
+    "config:base"
+  ]
+}

vendor/modules.txt

@@ -116,6 +116,9 @@ github.com/hashicorp/go-retryablehttp
 # github.com/jcelliott/lumber v0.0.0-20160324203708-dd349441af25
 ## explicit
 github.com/jcelliott/lumber
+# github.com/joho/godotenv v1.4.0
+## explicit; go 1.12
+github.com/joho/godotenv
 # github.com/juju/ansiterm v0.0.0-20210929141451-8b71cc96ebdc
 ## explicit; go 1.14
 github.com/juju/ansiterm