Documentation
¶
Index ¶
- Constants
- func CreateAttestationResolver(resolver oci.ImageDetailsResolver, mapping *config.PolicyMapping) (attestation.Resolver, error)
- func CreateImageDetailsResolver(imageSource *oci.ImageSpec) (oci.ImageDetailsResolver, error)
- func RegoFunctions(resolver attestation.Resolver) []*tester.Builtin
- func VerifySubject(ctx context.Context, subject []intoto.Subject, resolver attestation.Resolver) error
- type Evaluator
- type File
- type Input
- type MockPolicyEvaluator
- type Options
- type Policy
- type Resolver
- type Result
- type Summary
- type Violation
Constants ¶
View Source
const (
DefaultQuery = "result := data.attest.result"
)
Variables ¶
This section is empty.
Functions ¶
func CreateAttestationResolver ¶
func CreateAttestationResolver(resolver oci.ImageDetailsResolver, mapping *config.PolicyMapping) (attestation.Resolver, error)
func CreateImageDetailsResolver ¶
func CreateImageDetailsResolver(imageSource *oci.ImageSpec) (oci.ImageDetailsResolver, error)
func RegoFunctions ¶
func RegoFunctions(resolver attestation.Resolver) []*tester.Builtin
func VerifySubject ¶
func VerifySubject(ctx context.Context, subject []intoto.Subject, resolver attestation.Resolver) error
VerifySubject verifies if any of the given subject PURLs matches the image name and platform from resolver. Tags are not taken into account when attempting to match because sometimes the user may not have specified a tag, and maybe there isn't a purl subject with that particular tag (because of post build tagging?).
Types ¶
type Evaluator ¶
type Evaluator interface {
Evaluate(ctx context.Context, resolver attestation.Resolver, pctx *Policy, input *Input) (*Result, error)
}
func GetMockPolicy ¶
func GetMockPolicy() Evaluator
func NewRegoEvaluator ¶
type MockPolicyEvaluator ¶
type Options ¶
type Options struct {
TUFClientOptions *tuf.ClientOptions
DisableTUF bool
LocalTargetsDir string
LocalPolicyDir string
PolicyID string
ReferrersRepo string
AttestationStyle config.AttestationStyle
Debug bool
}
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
func NewResolver ¶
func NewResolver(tufClient tuf.Downloader, opts *Options) *Resolver
type Result ¶
type Result struct {
Success bool `json:"success"`
Violations []Violation `json:"violations"`
Summary Summary `json:"summary"`
}
func AllowedResult ¶
func AllowedResult() *Result
Click to show internal directories.
Click to hide internal directories.