Documentation
¶
Overview ¶
Package policy provides helper functions for creating BuildKit source policies. It wraps the official github.com/moby/buildkit/sourcepolicy/pb types.
Index ¶
- Constants
- func AddGitChecksumRule(p *Policy, gitURL, checksum string)
- func AddHTTPChecksumRule(p *Policy, url, checksum string)
- func AddHTTPChecksumRuleWithHeaders(p *Policy, url, checksum string, headers map[string]string)
- func AddPinRule(p *Policy, originalRef, pinnedRef string)
- func Validate(p *Policy) error
- func ValidateWithEvaluate(ctx context.Context, p *Policy) error
- type AttrConstraint
- type AttrMatch
- type MatchType
- type Policy
- type PolicyAction
- type Rule
- type Selector
- type Update
Constants ¶
const ( PolicyActionAllow = spb.PolicyAction_ALLOW PolicyActionDeny = spb.PolicyAction_DENY PolicyActionConvert = spb.PolicyAction_CONVERT MatchTypeWildcard = spb.MatchType_WILDCARD MatchTypeExact = spb.MatchType_EXACT MatchTypeRegex = spb.MatchType_REGEX AttrMatchEqual = spb.AttrMatch_EQUAL AttrMatchNotEqual = spb.AttrMatch_NOTEQUAL AttrMatchMatches = spb.AttrMatch_MATCHES )
Re-export constants
Variables ¶
This section is empty.
Functions ¶
func AddGitChecksumRule ¶
AddGitChecksumRule adds a rule that pins a Git source to a specific commit checksum The gitURL should be the original URL as it appears in the Dockerfile (e.g., https://github.com/owner/repo.git#ref) The checksum should be the full 40-character commit SHA
func AddHTTPChecksumRule ¶
AddHTTPChecksumRule adds a rule that pins an HTTP/HTTPS source to a specific checksum The checksum should be in the format "sha256:..." or similar digest format
func AddHTTPChecksumRuleWithHeaders ¶
AddHTTPChecksumRuleWithHeaders adds a rule that pins an HTTP/HTTPS source to a specific checksum and optionally includes HTTP headers in the source policy.
Headers are stored with the "http.header." prefix as defined by BuildKit's AttrHTTPHeaderPrefix. This is important for resources that vary by request headers (indicated by the Vary response header).
Example: If a resource varies by Accept-Encoding, the headers map should contain:
{"accept-encoding": "gzip, deflate"}
This will be stored in the policy as "http.header.accept-encoding" attribute.
func AddPinRule ¶
AddPinRule adds a rule that pins an image reference to a specific digest
func Validate ¶
Validate checks that the policy is valid by performing a JSON round-trip through the BuildKit sourcepolicy/pb types. This is the same validation that BuildKit performs when loading a policy file via json.Unmarshal.
func ValidateWithEvaluate ¶
ValidateWithEvaluate performs deeper validation by running each rule through BuildKit's sourcepolicy engine. This tests that the generated rules can actually be evaluated against source operations, providing runtime validation beyond structural correctness.
Types ¶
type AttrConstraint ¶
type AttrConstraint = spb.AttrConstraint
Re-export types from buildkit sourcepolicy/pb for convenience
type PolicyAction ¶
type PolicyAction = spb.PolicyAction
Re-export types from buildkit sourcepolicy/pb for convenience
Source Files