Extends the builtin default policy to verify docker-github-builder
signatures on docker/buildkit-syft-scanner images. Tags `latest` and
1.10+ require a signature from the docker/buildkit-syft-scanner source
repository; older tags pass through unchanged. Factors the shared ref
matching logic into sig_ref_matches for dockerfile and introduces a
syft-scanner variant that uses the plain refs/tags/ prefix.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Embed an opt-in default source policy for Docker-managed frontend images.
Load it ahead of user policies when enabled, and cover behavior with table-
driven policy tests for signed, unsigned, floating, and labs tags.
Makes sure if there is any attack against the docker/dockerfile
releases, or they accidentally point to worng images, these are automatically detected.
In a future release these should become opt-out.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Tonis Tiigi