docker/attest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add policy, oci, attestation

Browse Source
This commit is contained in:
mrjoelkamp
2024-04-22 12:22:15 -05:00
parent 20f83f6189
commit a3422b5331
78 changed files with 2021 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/policy/testdata/mock-tuf-allow/doi/data.yaml vendored Normal file
View File

@@ -0,0 +1 @@
config:

5
pkg/policy/testdata/mock-tuf-allow/doi/policy.rego vendored Normal file
View File

@@ -0,0 +1,5 @@
package docker
import rego.v1
allow := true

10
pkg/policy/testdata/mock-tuf-allow/mapping.yaml vendored Normal file
View File

@@ -0,0 +1,10 @@
# map repos to policies
version: v1
kind: policy-mapping
policies:
- origin:
domain: docker.io
prefix: library/
name: docker-official-images
description: Docker Official Images
location: doi

1
pkg/policy/testdata/mock-tuf-deny/doi/data.yaml vendored Normal file
View File

@@ -0,0 +1 @@
config:

5
pkg/policy/testdata/mock-tuf-deny/doi/policy.rego vendored Normal file
View File

@@ -0,0 +1,5 @@
package docker
import rego.v1
allow := false

10
pkg/policy/testdata/mock-tuf-deny/mapping.yaml vendored Normal file
View File

@@ -0,0 +1,10 @@
# map repos to policies
version: v1
kind: policy-mapping
policies:
- origin:
domain: docker.io
prefix: library/
name: docker-official-images
description: Docker Official Images
location: doi

1
pkg/policy/testdata/mock-tuf-verify-sig/doi/data.yaml vendored Normal file
View File

@@ -0,0 +1 @@
config:

15
pkg/policy/testdata/mock-tuf-verify-sig/doi/policy.rego vendored Normal file
View File

@@ -0,0 +1,15 @@
package docker
import rego.v1
keys := [{
"id": "a0c296026645799b2a297913878e81b0aefff2a0c301e97232f717e14402f3e4",
"key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgH23D1i2+ZIOtVjmfB7iFvX8AhVN\n9CPJ4ie9axw+WRHozGnRy99U2dRge3zueBBg2MweF0zrToXGig2v3YOrdw==\n-----END PUBLIC KEY-----",
"from": "2023-12-15T14:00:00Z",
"to": null
}]
allow if {
some env in attestations.attestation("foo")
statement := attestations.verify_envelope(env, keys)
}

10
pkg/policy/testdata/mock-tuf-verify-sig/mapping.yaml vendored Normal file
View File

@@ -0,0 +1,10 @@
# map repos to policies
version: v1
kind: policy-mapping
policies:
- origin:
domain: docker.io
prefix: library/
name: docker-official-images
description: Docker Official Images
location: doi

1
pkg/policy/testdata/mock-tuf-wrong-key/doi/data.yaml vendored Normal file
View File

@@ -0,0 +1 @@
config:

19
pkg/policy/testdata/mock-tuf-wrong-key/doi/policy.rego vendored Normal file
View File

@@ -0,0 +1,19 @@
package docker
import rego.v1
keys := {
"a0c296026645799b2a297913878e81b0aefff2a0c301e97232f717e14402f3e4": {
"id": "a0c296026645799b2a297913878e81b0aefff2a0c301e97232f717e14402f3e4",
"key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHyZpSgzvqFqNv7f3x7865OS38rAb\nQMcff55zM2UH/KR3Pr84a8QsGDNgaNGzJQJWjtMSgfV8WnNoffNK+svFNg==\n-----END PUBLIC KEY-----",
"from": "2023-12-15T14:00:00Z",
"to": null,
}
}
allow if {
some env in attestations.attestation("foo")
statement := attestations.verify_envelope(env, keys)
}
allow := true

10
pkg/policy/testdata/mock-tuf-wrong-key/mapping.yaml vendored Normal file
View File

@@ -0,0 +1,10 @@
# map repos to policies
version: v1
kind: policy-mapping
policies:
- origin:
domain: docker.io
prefix: library/
name: docker-official-images
description: Docker Official Images
location: doi