1a7897a052
* Start of richer results from verification * Pull out VSA code from signing * Expose attestation signing fns * Add VSA test * Notes for policy result * Require separate policy for VSA creation * Load test signing key from tests * Return rich object from policy * Add result object schema and fix tests * Ensure example test runs * Remove data.yaml files from mock policies * Don't run example - TUF policy isn't compatible * Add attestation to manifests for all subjects * Ensure adding attestation doesn't touch statements * Don't export sign function * Remove attestations from VerificationResult * Change bool to Outcome enum in result * Use outputLayout directly * Make clearer that Outcome strings are for VSA * Return multiple SLSA levels from policy * Fix unmarshalling of policy-id (#39) * Rename function * Rename policy.VerificationResult -> policy.Result * Re-add test for canonical input --------- Co-authored-by: James Carnegie <james.carnegie@docker.com> Co-authored-by: James Carnegie <kipz@users.noreply.github.com>
49 lines
1.2 KiB
Rego
49 lines
1.2 KiB
Rego
package attest
|
|
|
|
import rego.v1
|
|
|
|
keys := [{
|
|
"id": "6b241993defaba26558c64f94a94303ce860e7ad9163d801495c91cf57197c75",
|
|
"key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZmicqYSY38DprGr42jU0V3ND0ROj\nzSRH1+yjsxhh0bi52Hh/DuOhrSq2KJ5a09lW3ybnDjljowbkof0Y1i9Oow==\n-----END PUBLIC KEY-----",
|
|
"from": "2023-12-15T14:00:00Z",
|
|
"to": null,
|
|
# this key is still active
|
|
"status": "active",
|
|
"signing-format": "dssev1",
|
|
}]
|
|
|
|
atts := union({
|
|
attestations.attestation("https://slsa.dev/provenance/v0.2"),
|
|
attestations.attestation("https://spdx.dev/Document"),
|
|
})
|
|
|
|
statements contains s if {
|
|
some att in atts
|
|
s := attestations.verify_envelope(att, keys)
|
|
}
|
|
|
|
subjects contains subject if {
|
|
some statement in statements
|
|
some subject in statement.subject
|
|
}
|
|
|
|
violations contains v if {
|
|
v := {
|
|
"type": "missing_attestation",
|
|
"description": "Attestation missing for subject",
|
|
"attestation": null,
|
|
"details": {},
|
|
}
|
|
}
|
|
|
|
result := {
|
|
"success": false,
|
|
"violations": violations,
|
|
"summary": {
|
|
"subjects": subjects,
|
|
"slsa_levels": ["SLSA_BUILD_LEVEL_3"],
|
|
"verifier": "docker-official-images",
|
|
"policy_uri": "https://docker.com/official/policy/v0.1",
|
|
},
|
|
}
|