alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
3,903 Commits 1 Branch 1 Tag
4880756a0f5066b5a15034f2a030fcf96433c03b
Commit Graph
36 Commits
Author SHA1 Message Date
Tonis Tiigi 4880756a0f policy: simplify recursive material resolution 
Unify root/material unknown resolution with recursive Input traversal.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-26 09:14:25 -08:00
Tonis Tiigi 5c3551beeb policy: add GitHub attestation verification 
Add github_attestation and github_release_attestation policy support.
Fetch GitHub attestation bundles (including bundle_url .json.sn decode)
and verify against input.http.checksum.

Wire source metadata resolver progress through resolver options and add
ResolveState support for policy HTTP attestation fetches.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-20 08:56:40 -08:00
Tonis Tiigi ac9e4c512c policy: add artifact attestation builtin support 
Add artifact_attestation(http, filename) and wire verifier support for
artifact bundle checks. Add docker_github_builder_bundle helper rule.

Handle runtime unknown http.checksum after eval so metadata resolve is
requested when checksum is missing.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-20 08:56:39 -08:00
Tonis Tiigi 9f59d5b789 policy: add progress vertex error integration test 
Refactor policy error unit tests to table-driven subtests with slug names.
Add rawjson integration coverage to verify policy vertex captures DENY build
errors in progress output.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-19 18:13:58 -08:00
Tonis Tiigi 048ebea483 policy: mark policy progress vertex on DENY build failures 
Track denied source identifiers during policy evaluation and flag the policy
progress vertex as failed when BuildKit returns a matching DENY error pattern.

This improves the progress output of policy error and shows last
policy logs with the build error.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-18 17:19:54 -08:00
Tonis Tiigi dce5289722 policy: separate sourcemetaresolver utility to reusable pkg 
Turn the current utility used by policy helper commands that
allows getting gateway.Client lazily into reusable package.

This is preparation for using this utility also in the policy
verification, outside of commands.

Only expose SourceMetaResolver as other methods of gateway client
are not needed atm by any callers.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-13 13:59:33 -08:00
Tonis Tiigi 8d605dcd87 policy: add image.provenance input type 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-12 11:59:06 -08:00
Tonis Tiigi edd2461190 policy: add unit tests for AddUknowns 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-09 18:27:35 -08:00
Tonis Tiigi 4e16277937 policy: update unknown keys normalization 
Make the code more unified between validation and
test command. Normalize to key without the input prefix.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-09 18:27:35 -08:00
Tonis Tiigi df542b3f80 policy: add testcases for !hasProvenance and sha256 git 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-09 18:27:34 -08:00
Tonis Tiigi 6d2e4952b5 policy: add mock signature unit test 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-09 18:27:29 -08:00
Tonis Tiigi 22b3d36de3 policy: add unit tests for SourceToInput 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-09 16:30:25 -08:00
Tonis Tiigi 89fdef17e6 policy: fixes for image source handling 
- Make sure tag is added to image reference as
containerd reference parser refuses to parse otherwise.

- When attestation is asked from non-index, return
nil instead of error. This is for consistency as likely
to fail in BuildKit before that is fixed separately.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 12:12:41 -08:00
Tonis Tiigi db9c0c2532 policy: update unknown collection 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:56 -08:00
Tonis Tiigi 86885cd8a2 policy: add docker_github_builder_tag builtin helper 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:55 -08:00
Tonis Tiigi 1d19f3e2dd policy: add docker_github_builder builtin helper 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:55 -08:00
Tonis Tiigi 30260ec935 policy: improve policy logging 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:55 -08:00
Tonis Tiigi 20405112c2 policy: allow image source without set platform 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:55 -08:00
Tonis Tiigi eaee6675fb policy: fix exposing signature kind and type 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:53 -08:00
Tonis Tiigi c6ecdc08cf commands: implement policy test command 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 10:31:12 -08:00
Tonis Tiigi 6f9a1cfb17 tests: add git based policy tests 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:34:15 -08:00
Tonis Tiigi 4b4f2aa682 tests: add http policy integration tests 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:33:49 -08:00
Tonis Tiigi be42b48462 policy: implement policy logging via progress printer 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:10:34 -08:00
Tonis Tiigi 5ad09ce3eb commands: implement policy eval command 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:10:33 -08:00
Tonis Tiigi 0e1036bef5 policy: add multiple policy support 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:09:10 -08:00
Tonis Tiigi d0e9e8cab5 policy: add pin_image helper 
This helper can be used to pin images to specific digest to opt-out
out upgrades or replay old builds.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi df5d9eb8c2 policy: update verify_git_signature to take git object as parameter 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi 8906b254d3 policy: move custom functions to separate file 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi 87d4189039 policy: image signature verification support 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi b2697ae933 policy: add git signature verification support 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi 1b7a5f2fa9 policy: add custom builtin load_json 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi 70da643c58 policy: add helper modules loading 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi 7247c1e38e policy: print debug helper 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi 547f1ab36b policy: add custom builtins list and remove v0 compat 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:41 -08:00
Tonis Tiigi adb9386282 policy: remove http perm/uid/gid 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:41 -08:00
Tonis Tiigi 93341aaeee add rego integration to source policies 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:40 -08:00