policy: add artifact attestation and github attestation builtin support #3657
Conversation
| return nil, nil, err | ||
| } | ||
|
|
||
| rtUnk := runtimeUnknownInputRefs(st) |
There was a problem hiding this comment.
Looks like this could be bug previously if image signatures were the only requirement with no other unknown fields. Similar code is bit above, but it currently only ran in case of the Partial() code path.
| continue | ||
| } | ||
| if shouldDecodeSnappyBundleURL(bu) { | ||
| decoded, err := snappy.Decode(nil, bundleRaw) |
There was a problem hiding this comment.
fwiw I didn't find any documentation for this. When I wrote similar code couple of months ago in https://github.com/moby/policy-helpers/blob/main/githubapi/pull.go there was no bundle_url or snappy compression.
There was a problem hiding this comment.
Yes seems gh cli is doing the same: https://github.com/cli/cli/blob/6c3e39ffc481d5b9675451a201ae904b6d42c7cd/pkg/cmd/attestation/api/client.go#L222-L265
Looks like they also have some backoff logic, not sure if we should do the same.
tonistiigi
force-pushed
the
policy-artifact-verification
branch
from
846fc5c to
6606aee
Compare
Add artifact_attestation(http, filename) and wire verifier support for artifact bundle checks. Add docker_github_builder_bundle helper rule. Handle runtime unknown http.checksum after eval so metadata resolve is requested when checksum is missing. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add github_attestation and github_release_attestation policy support. Fetch GitHub attestation bundles (including bundle_url .json.sn decode) and verify against input.http.checksum. Wire source metadata resolver progress through resolver options and add ResolveState support for policy HTTP attestation fetches. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Prevent concurrent ResolveSourceMetadata calls from hanging while waiting for resolver initialization. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
tonistiigi
force-pushed
the
policy-artifact-verification
branch
from
675ceb5 to
10c5f00
Compare
|
Rebased after #3656 merge. |
2 participants
fixes #3640
depends on #3656