Tonis Tiigi
acaf251f0b
Extend the built-in policy to validate signed moby/buildkit release and floating tags before docker-container builders are created. Pull the image first, inspect it through Docker, and bind verification to the descriptor digest. Resolve signature attestations through the BuildKit API embedded in the Docker daemon. If pulling fails, use a local image while applying the same verification when the containerd image store exposes an immutable descriptor. Keep the classic image-store behavior unchanged because no descriptor is available. Allow unmanaged repositories and digest-only references unchanged. Add the allow-untrusted-image driver option as an explicit verification bypass. Document the behavior and add policy, digest-pinning, and local fallback coverage. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
46 lines
1.3 KiB
Go
46 lines
1.3 KiB
Go
package policy
|
|
|
|
import (
|
|
_ "embed"
|
|
"os"
|
|
"strconv"
|
|
"sync"
|
|
)
|
|
|
|
// DefaultPolicyFilename is the synthetic filename used for the embedded
|
|
// default policy when it is loaded as a regular policy file.
|
|
const DefaultPolicyFilename = "buildx_default_policy.rego"
|
|
|
|
//go:embed default.rego
|
|
var defaultPolicyModule []byte
|
|
|
|
// DefaultPolicyData returns the embedded default policy module bytes.
|
|
func DefaultPolicyData() []byte {
|
|
return defaultPolicyModule
|
|
}
|
|
|
|
// DefaultPolicy returns a Policy instance backed by the embedded default
|
|
// policy module. Any files in opt are replaced: the default policy is always
|
|
// evaluated standalone.
|
|
func DefaultPolicy(opt Opt) *Policy {
|
|
opt.Files = []File{{
|
|
Filename: DefaultPolicyFilename,
|
|
Data: DefaultPolicyData(),
|
|
}}
|
|
return NewPolicy(opt)
|
|
}
|
|
|
|
// DefaultPolicyEnabled reports whether the builtin default policies are
|
|
// enabled via the BUILDX_DEFAULT_POLICY environment variable. It is opt-in
|
|
// for now; a future release may flip the default to on. The gate covers both
|
|
// the default source policy applied to builds and the builder-image policy
|
|
// applied when creating container builders.
|
|
var DefaultPolicyEnabled = sync.OnceValue(func() bool {
|
|
if v, ok := os.LookupEnv("BUILDX_DEFAULT_POLICY"); ok {
|
|
if vv, err := strconv.ParseBool(v); err == nil {
|
|
return vv
|
|
}
|
|
}
|
|
return false
|
|
})
|