Documentation
¶
Overview ¶
Package policy is the engine module and command surface for policy-as-code. It is the CI/shift-left half of Phase 4: it evaluates a committed policy (internal/policy) against a scan Report and projects the allow/warn/deny outcome into the unified Finding model with the DS-RAT-POL- rule namespace, so a pipeline can gate on `dsecrat scan` output the same way `dsecrat policy eval` does.
The heavy lifting — the expression language, decision logic, waivers, and the explainable-deny feature — lives in internal/policy. This package resolves inputs from the target's Metadata (keeping Analyze a pure function of its inputs), runs the evaluation, and formats findings. Like the verify module it fails safe: with no policy configured it reports "not configured" (INFO) and gates nothing — never a false pass.
Index ¶
Examples ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EvalCommand ¶
EvalCommand implements `dsecrat policy eval`: gate a scan report against a policy.
Example ¶
ExampleEvalCommand runs the CI gate exactly as `dsecrat policy eval` would and pins its human output, so the gate's behavior is documented and verified.
EvalCommand([]string{
"--policy", filepath.Join("testdata", "gate.policy.json"),
"--report", filepath.Join("testdata", "report.json"),
"--signed", "false",
})
Output: Policy: ci-gate (mode enforce) Decision: DENY Denials: [HIGH] require-signature image is not signed by a trusted key [CRITICAL] no-critical-cves image has critical CVEs Warnings: [MEDIUM] restricted-license package under a restricted license
func Register ¶
Register adds the policy module to the registry. The master agent calls this from modules.Default() during integration; this package never edits the shared registry file. See NOTES.md for the exact one-line wiring.
func TestCommand ¶
TestCommand implements `dsecrat policy test`: run a committed policy test suite.
Types ¶
type Module ¶
type Module struct{}
Module is the policy-as-code gate capability (CAPABILITY_SPEC domain 8).
func (*Module) Analyze ¶
Analyze evaluates a policy against the target. Configuration travels via the target's Metadata so the module stays deterministic:
policy.file path to the policy document JSON (required to gate anything) policy.report path to a `dsecrat scan --format json` report to judge policy.now RFC3339 evaluation time for waiver expiry (deterministic) policy.explain "true" to attach an agent-consumable explanation (off by default) policy.signed "true" to assert the image is signed (else inferred from report) policy.verified comma-separated verified predicate-type URIs policy.registry image registry (else derived from the target reference) policy.repository/policy.tag/policy.digest image identity overrides
With no policy.file it reports "not configured" (INFO) and gates nothing.
Source Files