Tonis Tiigi
89fdef17e6
policy: fixes for image source handling
...
- Make sure tag is added to image reference as
containerd reference parser refuses to parse otherwise.
- When attestation is asked from non-index, return
nil instead of error. This is for consistency as likely
to fail in BuildKit before that is fixed separately.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-16 12:12:41 -08:00
Tonis Tiigi
db9c0c2532
policy: update unknown collection
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-16 11:48:56 -08:00
Tonis Tiigi
86885cd8a2
policy: add docker_github_builder_tag builtin helper
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-16 11:48:55 -08:00
Tonis Tiigi
1d19f3e2dd
policy: add docker_github_builder builtin helper
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-16 11:48:55 -08:00
Tonis Tiigi
30260ec935
policy: improve policy logging
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-16 11:48:55 -08:00
Tonis Tiigi
20405112c2
policy: allow image source without set platform
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-16 11:48:55 -08:00
Tonis Tiigi
eaee6675fb
policy: fix exposing signature kind and type
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-16 11:48:53 -08:00
Tonis Tiigi
c6ecdc08cf
commands: implement policy test command
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 10:31:12 -08:00
Tonis Tiigi
6f9a1cfb17
tests: add git based policy tests
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:34:15 -08:00
Tonis Tiigi
4b4f2aa682
tests: add http policy integration tests
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:33:49 -08:00
Tonis Tiigi
be42b48462
policy: implement policy logging via progress printer
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:10:34 -08:00
Tonis Tiigi
5ad09ce3eb
commands: implement policy eval command
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:10:33 -08:00
Tonis Tiigi
0e1036bef5
policy: add multiple policy support
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:09:10 -08:00
Tonis Tiigi
d0e9e8cab5
policy: add pin_image helper
...
This helper can be used to pin images to specific digest to opt-out
out upgrades or replay old builds.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:42 -08:00
Tonis Tiigi
df5d9eb8c2
policy: update verify_git_signature to take git object as parameter
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:42 -08:00
Tonis Tiigi
8906b254d3
policy: move custom functions to separate file
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:42 -08:00
Tonis Tiigi
87d4189039
policy: image signature verification support
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:42 -08:00
Tonis Tiigi
b2697ae933
policy: add git signature verification support
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:42 -08:00
Tonis Tiigi
1b7a5f2fa9
policy: add custom builtin load_json
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:42 -08:00
Tonis Tiigi
70da643c58
policy: add helper modules loading
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:42 -08:00
Tonis Tiigi
7247c1e38e
policy: print debug helper
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:42 -08:00
Tonis Tiigi
547f1ab36b
policy: add custom builtins list and remove v0 compat
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:41 -08:00
Tonis Tiigi
adb9386282
policy: remove http perm/uid/gid
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:41 -08:00
Tonis Tiigi
93341aaeee
add rego integration to source policies
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:40 -08:00
Tonis Tiigi