alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
4,388 Commits 1 Branch 1 Tag
1d8dde89b8aba914e05e45366770736fea1fd690
Commit Graph
7 Commits
Author SHA1 Message Date
Tonis Tiigi a57372e966 policy: add HTTP PGP signature verification builtin 
Add verify_http_pgp_signature Rego builtin for HTTP sources using
pgpsign with checksum-request/response flow through policy resolution.
Wire sourcemeta HTTP checksum request/response conversion and add tests.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-03-26 15:39:46 -07:00
Tonis Tiigi 1c4a436a0d policy: match parent unknown keys in collectUnknowns 
Allow child refs from partial evaluation to match allowed parent keys on
path boundaries and return canonical unknowns for metadata resolution.

Add tests for parent-child matching and boundary safety cases.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-26 17:12:18 -08:00
Tonis Tiigi 4880756a0f policy: simplify recursive material resolution 
Unify root/material unknown resolution with recursive Input traversal.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-26 09:14:25 -08:00
Tonis Tiigi 5c3551beeb policy: add GitHub attestation verification 
Add github_attestation and github_release_attestation policy support.
Fetch GitHub attestation bundles (including bundle_url .json.sn decode)
and verify against input.http.checksum.

Wire source metadata resolver progress through resolver options and add
ResolveState support for policy HTTP attestation fetches.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-20 08:56:40 -08:00
Tonis Tiigi ac9e4c512c policy: add artifact attestation builtin support 
Add artifact_attestation(http, filename) and wire verifier support for
artifact bundle checks. Add docker_github_builder_bundle helper rule.

Handle runtime unknown http.checksum after eval so metadata resolve is
requested when checksum is missing.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-20 08:56:39 -08:00
Tonis Tiigi 4e16277937 policy: update unknown keys normalization 
Make the code more unified between validation and
test command. Normalize to key without the input prefix.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-09 18:27:35 -08:00
Tonis Tiigi adb9386282 policy: remove http perm/uid/gid 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:41 -08:00