diff --git a/README.md b/README.md index d9744f11a..474811f6d 100644 --- a/README.md +++ b/README.md @@ -17,6 +17,7 @@ $ yarn start This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server. + ### Build ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md index 619e3b7c5..5e4ed6d44 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-bom.md +++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md @@ -169,7 +169,7 @@ To overcome the limitation install tool directly - **[installer](https://github. Containerized action can be used on Linux runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom@v1.5.10 + uses: scribe-security/action-bom@v1.5.11 with: target: 'busybox:latest' ``` @@ -177,7 +177,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom-cli@v1.5.10 + uses: scribe-security/action-bom-cli@v1.5.11 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-evidence.md b/docs/integrating-scribe/ci-integrations/github/action-evidence.md index 7910b8a75..93165a0c5 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-evidence.md +++ b/docs/integrating-scribe/ci-integrations/github/action-evidence.md @@ -136,7 +136,7 @@ The `valint evidence` action is a versatile action designed to include various t Containerized action can be used on Linux runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence@v1.5.10 + uses: scribe-security/action-evidence@v1.5.11 with: target: some_file.json ``` @@ -144,7 +144,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence-cli@v1.5.10 + uses: scribe-security/action-evidence-cli@v1.5.11 with: target: some_file.json ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-slsa.md b/docs/integrating-scribe/ci-integrations/github/action-slsa.md index a994e1c5f..44770d8e2 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-slsa.md +++ b/docs/integrating-scribe/ci-integrations/github/action-slsa.md @@ -155,7 +155,7 @@ To overcome the limitation install tool directly - [installer](https://github.co Containerized action can be used on Linux runners as following ```yaml - name: Generate SLSA provenance - uses: scribe-security/action-slsa@v1.5.10 + uses: scribe-security/action-slsa@v1.5.11 with: target: 'busybox:latest' ``` @@ -163,7 +163,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-slsa-cli@v1.5.10 + uses: scribe-security/action-slsa-cli@v1.5.11 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md index fe5a94099..533f1facf 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-verify.md +++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md @@ -63,6 +63,8 @@ The command allows users to verify any target against its evidence. description: Default policy allowed emails force: description: Force skip cache + format: + description: Policy Result Evidence format, options=[statement-sarif attest-sarif sarif ] git-auth: description: 'Git repository authentication info, [format: ''username:password'']' git-branch: @@ -74,7 +76,7 @@ The command allows users to verify any target against its evidence. initiative: description: Run only rules with specified initiative input-format: - description: Evidence format, options=[attest-cyclonedx-json attest-slsa statement-slsa statement-cyclonedx-json statement-generic attest-generic ] + description: Input Evidence format, options=[attest-cyclonedx-json attest-slsa statement-slsa statement-cyclonedx-json statement-generic attest-generic ] key: description: x509 Private key path kms: @@ -161,7 +163,7 @@ Containerized action can be used on Linux runners as following ```yaml - name: valint verify id: valint_verify - uses: scribe-security/action-verify@v1.5.10 + uses: scribe-security/action-verify@v1.5.11 with: target: 'busybox:latest' ``` @@ -169,7 +171,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-verify-cli@v1.5.10 + uses: scribe-security/action-verify-cli@v1.5.11 with: target: 'hello-world:latest' ``` diff --git a/docs/platforms/bom.md b/docs/platforms/bom.md index d03e754db..a780d9e64 100644 --- a/docs/platforms/bom.md +++ b/docs/platforms/bom.md @@ -67,7 +67,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7f98996193a0>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7fb5d78c6480>, default: []) --unique Allow unique assets (default: False) subcommands: @@ -148,12 +148,12 @@ Note that the image characterization string is a wildcarded string, some useful usage: platforms [options] bom [options] dockerhub [-h] [--instance INSTANCE] [--default_product_key_strategy {namespace,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] - [--scope.namespace [NAMESPACE ...]] [--scope.repository [REPOSITORY ...]] + [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--image.mapping [MAPPING ...]] + [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -162,8 +162,6 @@ options: Override product key with namespace, repository or image names (default: mapping) --default_product_version_strategy {tag,short_image_id,image_id} Override product version with tag or image id (default: short_image_id) - --scope.namespace [NAMESPACE ...] - Dockerhub namespaces (default: ['*']) --scope.repository [REPOSITORY ...] Dockerhub repositories (default: ['*']) --scope.repository_tags [REPOSITORY_TAGS ...] @@ -174,6 +172,8 @@ options: Dockerhub repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Dockerhub tags to exclude (default: []) + --scope.namespace [NAMESPACE ...] + Dockerhub namespaces (default: ['*']) --image.mapping [MAPPING ...] Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) @@ -410,7 +410,7 @@ Note that the image characterization string is a wildcarded string, some useful ```bash usage: platforms [options] bom [options] bitbucket [-h] [--instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] - [--workspace_name WORKSPACE_NAME] [--types {repository,all}] + [--workspace_name WORKSPACE_NAME] --url URL [--types {repository,all}] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] @@ -422,14 +422,15 @@ options: -h, --help Show this help message and exit. --instance INSTANCE BitBucket instance string (default: ) --app_password APP_PASSWORD - BitBucket app_password (default: null) + BitBucket app_password (BB_PASSWORD) (default: ) --username USERNAME BitBucket username (default: null) --workspace_token WORKSPACE_TOKEN BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and - --username (default: null) + --username (BB_WORKSPACE_TOKEN) (default: ) --workspace_name WORKSPACE_NAME BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and --username (default: null) + --url URL BitBucket URL (required) --types {repository,all} Specifies the type of evidence to generate, scoped by scope parameters (default: repository) --scope.workspace [WORKSPACE ...] @@ -491,7 +492,7 @@ usage: platforms [options] bom [options] github [-h] [--instance INSTANCE] [--to options: -h, --help Show this help message and exit. --instance INSTANCE Github instance string (default: ) - --token TOKEN Github token (required, default: ) + --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) --url URL Github base URL (default: https://github.com) --types {repository,all} Specifies the type of evidence to generate, scoped by scope parameters (default: repository) @@ -548,7 +549,7 @@ usage: platforms [options] bom [options] gitlab [-h] [--instance INSTANCE] [--to options: -h, --help Show this help message and exit. --instance INSTANCE Gitlab instance string (default: ) - --token TOKEN Gitlab token (required, default: ) + --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) --url URL Gitlab base URL (default: https://gitlab.com/) --types {project,all} Specifies the type of evidence to generate, scoped by scope parameters (default: all) diff --git a/docs/platforms/discover.md b/docs/platforms/discover.md index b0213cc72..fa737d0e4 100644 --- a/docs/platforms/discover.md +++ b/docs/platforms/discover.md @@ -75,7 +75,7 @@ options: --instance INSTANCE Gitlab instance string (default: ) --types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) - --token TOKEN Gitlab token (required, default: ) + --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) --url URL Gitlab base URL (default: https://gitlab.com/) --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) @@ -138,7 +138,7 @@ options: --instance INSTANCE Github instance string (default: ) --types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) - --token TOKEN Github token (required, default: ) + --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) --url URL Github base URL (default: https://github.com) --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) @@ -184,26 +184,25 @@ DockerHub discovery samples the following assets: namespaces, repositories, and ```bash usage: platforms [options] discover [options] dockerhub [-h] [--instance INSTANCE] - [--types {namespace,repository,repository_tag,webhook,token,all} [{namespace,repository,repository_tag,webhook,token,all} ...]] - [--username USERNAME] [--password PASSWORD] [--url URL] - [--scope.namespace [NAMESPACE ...]] - [--scope.repository [REPOSITORY ...]] + [--types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...]] + [--username USERNAME] [--password PASSWORD] [--token TOKEN] + [--url URL] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.past_days PAST_DAYS] [--broad] + [--namespace-list [NAMESPACE_LIST ...]] [--scope.past_days PAST_DAYS] + [--broad] options: -h, --help Show this help message and exit. --instance INSTANCE Dockerhub instance string (default: ) - --types {namespace,repository,repository_tag,webhook,token,all} [{namespace,repository,repository_tag,webhook,token,all} ...] + --types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) --username USERNAME Dockerhub username (default: null) - --password PASSWORD Dockerhub password (default: null) + --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) (default: ) + --token TOKEN Dockerhub token (default: ) --url URL Dockerhub base URL (default: https://hub.docker.com) - --scope.namespace [NAMESPACE ...] - Dockerhub namespaces (default: ['*']) --scope.repository [REPOSITORY ...] Dockerhub repositories (default: ['*']) --scope.repository_tags [REPOSITORY_TAGS ...] @@ -214,6 +213,8 @@ options: Dockerhub repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Dockerhub tags to exclude (default: []) + --namespace-list [NAMESPACE_LIST ...] + List of namespaces (default: []) --scope.past_days PAST_DAYS Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) --broad Retrieves limited information (only namespaces and repositories) (default: False) @@ -270,7 +271,7 @@ options: --types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) --url URL Kubernetes API URL (required, default: ) - --token TOKEN Kubernetes token, with access to pods and secrets (required, default: ) + --token TOKEN Kubernetes token, with access to pods and secrets (K8S_TOKEN) (default: ) --scope.namespace [NAMESPACE ...] Kubernetes namespaces wildcard list (default: ['*']) --scope.pod [POD ...] @@ -353,7 +354,7 @@ options: --instance INSTANCE Jfrog instance string (default: ) --types {jf-repository,repository,repository_tag,user,token,webhook,all} [{jf-repository,repository,repository_tag,user,token,webhook,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) - --token TOKEN Jfrog token (default: null) + --token TOKEN Jfrog token (JFROG_TOKEN) (default: ) --url URL Jfrog base URL (default: null) --scope.jf-repository [JF_REPOSITORY ...] Jfrog repositories (default: ['*']) @@ -384,7 +385,7 @@ options: ECR discovery samples the following assets: ECR repositories, Image repositories, and Image Tags. For example `.dkr.ecr.us-west-2.amazonaws.com/my_image:latest` -* `.dkr.ecr.us-west-2.amazonaws.com`: Instance URL +* ``.dkr.ecr.us-west-2.amazonaws.com`: Instance URL * `my_image` A image Repository, Includes a set of Image Tags. * `my_image:latest` A image Repository. @@ -411,7 +412,7 @@ options: --instance INSTANCE ECR instance string (default: ) --types {aws-account,repository,repository_tags,all} [{aws-account,repository,repository_tags,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) - --token TOKEN ECR token (default: null) + --token TOKEN ECR token (ECR_LOGIN_TOKEN) (default: ) --url URL ECR base URL (default: null) --scope.aws-account [AWS_ACCOUNT ...] ECR repositories (default: ['*']) @@ -448,28 +449,29 @@ BitBucket discovery samples the following assets: workspaces, projects, reposito ```bash usage: platforms [options] discover [options] bitbucket [-h] [--instance INSTANCE] - [--types {workspace,project,repository,branch,commit,member,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,all} [{workspace,project,repository,branch,commit,member,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,all} ...]] + [--types {workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,all} [{workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,all} ...]] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace_name WORKSPACE_NAME] - [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] - [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] - [--commit.skip] [--broad] + --url URL [--scope.workspace [WORKSPACE ...]] + [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] + [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] + [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--broad] options: -h, --help Show this help message and exit. --instance INSTANCE BitBucket instance string (default: ) - --types {workspace,project,repository,branch,commit,member,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,all} [{workspace,project,repository,branch,commit,member,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,all} ...] + --types {workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,all} [{workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) --app_password APP_PASSWORD - BitBucket app_password (default: null) + BitBucket app_password (BB_PASSWORD) (default: ) --username USERNAME BitBucket username (default: null) --workspace_token WORKSPACE_TOKEN BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and - --username (default: null) + --username (BB_WORKSPACE_TOKEN) (default: ) --workspace_name WORKSPACE_NAME BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and --username (default: null) + --url URL BitBucket URL (required) --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] @@ -512,7 +514,7 @@ options: -h, --help Show this help message and exit. --instance INSTANCE Jenkins instance string (default: ) --username USERNAME Jenkins username (default: ) - --password PASSWORD Jenkins token (default: ) + --password PASSWORD Jenkins token (JENKINS_PASSWORD) (default: ) --url URL Jenkins base URL (default: null) --broad Perform a fast broad discovery instead of a detailed one (default: False) --types {all,computer_set,users,jobs,job_runs,credential_stores,all} [{all,computer_set,users,jobs,job_runs,credential_stores,all} ...] diff --git a/docs/platforms/evidence.md b/docs/platforms/evidence.md index 4671c2592..67f1ce281 100644 --- a/docs/platforms/evidence.md +++ b/docs/platforms/evidence.md @@ -69,7 +69,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7fa8e751a980>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7fa2a7167a60>, default: []) --unique Allow unique assets (default: False) subcommands: @@ -152,7 +152,7 @@ usage: platforms [options] evidence [options] gitlab [-h] [--instance INSTANCE] options: -h, --help Show this help message and exit. --instance INSTANCE Gitlab instance string (default: ) - --token TOKEN Gitlab token (required, default: ) + --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) --url URL Gitlab base URL (default: https://gitlab.com/) --types {organization,project,all} Defines which evidence to create, scoped by scope parameters (default: all) @@ -237,7 +237,7 @@ usage: platforms [options] evidence [options] github [-h] [--instance INSTANCE] options: -h, --help Show this help message and exit. --instance INSTANCE Github instance string (default: ) - --token TOKEN Github token (required, default: ) + --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) --url URL Github base URL (default: https://github.com) --types {organization,repository,all,all} Defines which evidence to create, scoped by scope parameters (default: all) @@ -282,13 +282,14 @@ platforms evidence dockerhub --namespace.mapping "my-namespace::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] dockerhub [-h] [--instance INSTANCE] [--types {token,repository,namespace,all}] - [--scope.namespace [NAMESPACE ...]] +usage: platforms [options] evidence [options] dockerhub [-h] [--instance INSTANCE] + [--types {instance,token,repository,namespace,repository_tag,webhook,all}] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--scope.namespace [NAMESPACE ...]] [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--token.mapping [MAPPING ...]] [--namespace.single] [--repository.single] @@ -297,10 +298,8 @@ usage: platforms [options] evidence [options] dockerhub [-h] [--instance INSTANC options: -h, --help Show this help message and exit. --instance INSTANCE Dockerhub instance string (default: ) - --types {token,repository,namespace,all} + --types {instance,token,repository,namespace,repository_tag,webhook,all} Defines which evidence to create, scoped by scope parameters (default: all) - --scope.namespace [NAMESPACE ...] - Dockerhub namespaces (default: ['*']) --scope.repository [REPOSITORY ...] Dockerhub repositories (default: ['*']) --scope.repository_tags [REPOSITORY_TAGS ...] @@ -311,6 +310,8 @@ options: Dockerhub repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Dockerhub tags to exclude (default: []) + --scope.namespace [NAMESPACE ...] + Dockerhub namespaces (default: ['*']) --namespace.mapping [MAPPING ...] Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) diff --git a/docs/platforms/verify.md b/docs/platforms/verify.md index a1211883b..6c2044e7d 100644 --- a/docs/platforms/verify.md +++ b/docs/platforms/verify.md @@ -29,7 +29,7 @@ usage: platforms [options] verify [-h] [--valint.scribe.client-id CLIENT_ID] [-- [--valint.bundle-auth BUNDLE_AUTH] [--valint.bundle-branch BUNDLE_BRANCH] [--valint.bundle-commit BUNDLE_COMMIT] [--valint.bundle-tag BUNDLE_TAG] [--allow-failures] [--max-threads MAX_THREADS] - {k8s,dockerhub,gitlab,github,jfrog,ecr,bitbucket} ... + {k8s,dockerhub,gitlab,github,jfrog,ecr,bitbucket,jenkins} ... Verify supply chain policies @@ -61,7 +61,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7f824aa9b2e0>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7f8df8d50400>, default: []) --unique Allow unique assets (default: False) --valint.bundle BUNDLE Set bundle git branch (type: str, default: ) @@ -88,6 +88,7 @@ subcommands: jfrog ecr bitbucket + jenkins ``` @@ -157,7 +158,7 @@ usage: platforms [options] verify [options] gitlab [-h] [--instance INSTANCE] [- options: -h, --help Show this help message and exit. --instance INSTANCE Gitlab instance string (default: ) - --token TOKEN Gitlab token (required, default: ) + --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) --url URL Gitlab base URL (default: https://gitlab.com/) --types {organization,project,all} Defines which evidence to consume, scoped by scope parameters (default: all) @@ -216,7 +217,7 @@ usage: platforms [options] verify [options] github [-h] [--instance INSTANCE] [- options: -h, --help Show this help message and exit. --instance INSTANCE Github instance string (default: ) - --token TOKEN Github token (required, default: ) + --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) --url URL Github base URL (default: https://github.com) --types {organization,repository,all} Defines which evidence to validate, scoped by scope parameters (default: all) @@ -265,23 +266,23 @@ To evaluate policies on DockerHub evidence. ```bash usage: platforms [options] verify [options] dockerhub [-h] [--instance INSTANCE] [--username USERNAME] [--password PASSWORD] - [--url URL] [--types {token,repository,namespace,all}] + [--token TOKEN] [--url URL] [--types {token,repository,namespace,all}] [--default_product_key_strategy {namespace,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] - [--scope.namespace [NAMESPACE ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--image.mapping [MAPPING ...]] [--image.policy [POLICY ...]] - [--policy-skip-aggregate] + [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] + [--image.policy [POLICY ...]] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. --instance INSTANCE Dockerhub instance string (default: ) --username USERNAME Dockerhub username (default: null) - --password PASSWORD Dockerhub password (default: null) + --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) (default: ) + --token TOKEN Dockerhub token (default: ) --url URL Dockerhub base URL (default: https://hub.docker.com) --types {token,repository,namespace,all} Defines which evidence to create, scoped by scope parameters (default: all) @@ -289,8 +290,6 @@ options: Override product key with namespace, repository or image names (default: mapping) --default_product_version_strategy {tag,short_image_id,image_id} Override product version with tag or image id (default: short_image_id) - --scope.namespace [NAMESPACE ...] - Dockerhub namespaces (default: ['*']) --scope.repository [REPOSITORY ...] Dockerhub repositories (default: ['*']) --scope.repository_tags [REPOSITORY_TAGS ...] @@ -301,6 +300,8 @@ options: Dockerhub repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Dockerhub tags to exclude (default: []) + --scope.namespace [NAMESPACE ...] + Dockerhub namespaces (default: ['*']) --image.mapping [MAPPING ...] Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) @@ -360,7 +361,7 @@ options: -h, --help Show this help message and exit. --instance INSTANCE Kubernetes instance string (default: ) --url URL Kubernetes API URL (required, default: ) - --token TOKEN Kubernetes token, with access to pods and secrets (required, default: ) + --token TOKEN Kubernetes token, with access to pods and secrets (K8S_TOKEN) (default: ) --types {namespace,pod,cluster-images,all} Defines which evidence to create, scoped by scope parameters (default: cluster-images) --default_product_key_strategy {namespace,pod,image,mapping} @@ -450,7 +451,7 @@ usage: platforms [options] verify [options] jfrog [-h] [--instance INSTANCE] [-- options: -h, --help Show this help message and exit. --instance INSTANCE Jfrog instance string (default: ) - --token TOKEN Jfrog token (default: null) + --token TOKEN Jfrog token (JFROG_TOKEN) (default: ) --url URL Jfrog base URL (default: null) --types {token,repository,jf-repository,all} Defines which evidence to create, scoped by scope parameters (default: all) @@ -499,7 +500,7 @@ platforms verify bitbucket --workspace.mapping "my-workspace::my-product::1.0" - ```bash usage: platforms [options] verify [options] bitbucket [-h] [--instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] - [--workspace_name WORKSPACE_NAME] + [--workspace_name WORKSPACE_NAME] --url URL [--types {workspace,project,repository,all}] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] @@ -514,14 +515,15 @@ options: -h, --help Show this help message and exit. --instance INSTANCE BitBucket instance string (default: ) --app_password APP_PASSWORD - BitBucket app_password (default: null) + BitBucket app_password (BB_PASSWORD) (default: ) --username USERNAME BitBucket username (default: null) --workspace_token WORKSPACE_TOKEN BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and - --username (default: null) + --username (BB_WORKSPACE_TOKEN) (default: ) --workspace_name WORKSPACE_NAME BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and --username (default: null) + --url URL BitBucket URL (required) --types {workspace,project,repository,all} Defines which evidence to validate, scoped by scope parameters (default: all) --scope.workspace [WORKSPACE ...] diff --git a/docs/valint/getting-started-valint.md b/docs/valint/getting-started-valint.md index 74b82aad4..0626acf57 100644 --- a/docs/valint/getting-started-valint.md +++ b/docs/valint/getting-started-valint.md @@ -11,7 +11,7 @@ Valint is a tool used to manage `evidence` generation (for directories, file art Valint also enables you to **capture** any 3rd party report, scan or configuration (any file) into evidence. -> Latest Version `v1.5.10`. +> Latest Version `v1.5.11`. ### Installing Valint diff --git a/docs/valint/help/valint_diff.md b/docs/valint/help/valint_diff.md index 6aef2c536..d6cfb9900 100644 --- a/docs/valint/help/valint_diff.md +++ b/docs/valint/help/valint_diff.md @@ -49,7 +49,7 @@ global flag for all commands | -C | --context-type | CI context type, options=[jenkins github circleci local gitlab] | "local" | | -L | --label | Add Custom labels | | | -D | --level | Log depth level, options=[panic fatal error warning info debug trace] | | -| -d | --output-directory | Output directory path | "$\{XDG_CACHE_HOME\}/valint" | +| -d | --output-directory | Output directory path | "${XDG_CACHE_HOME}/valint" | | -O | --output-file | Output file name | | | -n | --product-key | Scribe Project Key | | | -q | --quiet | Suppress all logging output | | diff --git a/docs/valint/help/valint_verify.md b/docs/valint/help/valint_verify.md index f132fb76f..67592b2f2 100644 --- a/docs/valint/help/valint_verify.md +++ b/docs/valint/help/valint_verify.md @@ -35,13 +35,14 @@ Flags for `verify` subcommand | | --disable-crl | Disable certificate revocation verificatoin | | | | --email | Default policy allowed emails | | | -f | --force | Force skip cache | | +| -o | --format | Policy Result Evidence format, options=[statement-sarif attest-sarif sarif ] | | | | --git-auth | Git repository authentication info, [format: 'username:password'] | | | | --git-branch | Git branch in the repository | | | | --git-commit | Git commit hash in the repository | | | | --git-tag | Git tag in the repository | | | -h | --help | help for verify | | | | --initiative | Run only rules with specified initiative | | -| -i | --input-format | Evidence format, options=[attest-cyclonedx-json attest-slsa statement-slsa statement-cyclonedx-json statement-generic attest-generic ] | | +| -i | --input-format | Input Evidence format, options=[attest-cyclonedx-json attest-slsa statement-slsa statement-cyclonedx-json statement-generic attest-generic ] | | | | --key | x509 Private key path | | | | --kms | Provide KMS key reference | | | | --oci | Enable OCI store | |