Tonis Tiigi
0e50635195
Embed an opt-in default source policy for Docker-managed frontend images. Load it ahead of user policies when enabled, and cover behavior with table- driven policy tests for signed, unsigned, floating, and labs tags. Makes sure if there is any attack against the docker/dockerfile releases, or they accidentally point to worng images, these are automatically detected. In a future release these should become opt-out. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
18 lines
425 B
Go
18 lines
425 B
Go
package policy
|
|
|
|
import (
|
|
_ "embed"
|
|
)
|
|
|
|
// DefaultPolicyFilename is the synthetic filename used for the embedded
|
|
// default policy when it is loaded as a regular policy file.
|
|
const DefaultPolicyFilename = "buildx_default_policy.rego"
|
|
|
|
//go:embed default.rego
|
|
var defaultPolicyModule []byte
|
|
|
|
// DefaultPolicyData returns the embedded default policy module bytes.
|
|
func DefaultPolicyData() []byte {
|
|
return defaultPolicyModule
|
|
}
|