Tonis Tiigi
a57372e966
policy: add HTTP PGP signature verification builtin
...
Add verify_http_pgp_signature Rego builtin for HTTP sources using
pgpsign with checksum-request/response flow through policy resolution.
Wire sourcemeta HTTP checksum request/response conversion and add tests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-03-26 15:39:46 -07:00
Tonis Tiigi
9ef416b258
build: ref-count policy FS lifecycle
...
Make memoized policy FS ref-counted so repeated get()/close() pairs don't
prematurely close shared handles.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-02-26 18:48:38 -08:00
Tonis Tiigi
5c3551beeb
policy: add GitHub attestation verification
...
Add github_attestation and github_release_attestation policy support.
Fetch GitHub attestation bundles (including bundle_url .json.sn decode)
and verify against input.http.checksum.
Wire source metadata resolver progress through resolver options and add
ResolveState support for policy HTTP attestation fetches.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-02-20 08:56:40 -08:00
Tonis Tiigi
ac9e4c512c
policy: add artifact attestation builtin support
...
Add artifact_attestation(http, filename) and wire verifier support for
artifact bundle checks. Add docker_github_builder_bundle helper rule.
Handle runtime unknown http.checksum after eval so metadata resolve is
requested when checksum is missing.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-02-20 08:56:39 -08:00
Tonis Tiigi
d0e9e8cab5
policy: add pin_image helper
...
This helper can be used to pin images to specific digest to opt-out
out upgrades or replay old builds.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:42 -08:00
Tonis Tiigi
df5d9eb8c2
policy: update verify_git_signature to take git object as parameter
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:42 -08:00
Tonis Tiigi
8906b254d3
policy: move custom functions to separate file
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com >
2026-01-14 09:03:42 -08:00
Tonis Tiigi