Allow child refs from partial evaluation to match allowed parent keys on
path boundaries and return canonical unknowns for metadata resolution.
Add tests for parent-child matching and boundary safety cases.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add artifact_attestation(http, filename) and wire verifier support for
artifact bundle checks. Add docker_github_builder_bundle helper rule.
Handle runtime unknown http.checksum after eval so metadata resolve is
requested when checksum is missing.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Make the code more unified between validation and
test command. Normalize to key without the input prefix.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Tonis Tiigi